From 963331b5e2c7e72d6f71b57d8e8913334db0fbbd Mon Sep 17 00:00:00 2001 From: Arif Hussain Date: Thu, 27 Oct 2016 22:59:01 -0700 Subject: [PATCH 1/6] qcacld-3.0: Fix buffer overflow in __lim_process_roam_scan_offload_req In validation code, change condition local_ie_len <= to always less than QDF_ARRAY_SIZE(array) value, to avoid buffer overflow. Change-Id: I9612ce6e922dd481747253b3b35d74060439c159 CRs-Fixed: 1082162 --- core/mac/src/pe/lim/lim_process_sme_req_messages.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/core/mac/src/pe/lim/lim_process_sme_req_messages.c b/core/mac/src/pe/lim/lim_process_sme_req_messages.c index 9bf72ec16e1f..ace88d8a89d0 100644 --- a/core/mac/src/pe/lim/lim_process_sme_req_messages.c +++ b/core/mac/src/pe/lim/lim_process_sme_req_messages.c @@ -4156,16 +4156,17 @@ static void __lim_process_roam_scan_offload_req(tpAniSirGlobal mac_ctx, local_ie_buf = qdf_mem_malloc(MAX_DEFAULT_SCAN_IE_LEN); if (!local_ie_buf) { - lim_log(mac_ctx, LOGE, FL("Mem Alloc failed for local_ie_buf")); + lim_log(mac_ctx, LOGE, + FL("Mem Alloc failed for local_ie_buf")); return; } local_ie_len = req_buffer->assoc_ie.length; /* Update ext cap IE if present */ if (local_ie_len && - !lim_update_ext_cap_ie(mac_ctx, req_buffer->assoc_ie.addIEdata, - local_ie_buf, &local_ie_len)) { - if (local_ie_len <= + !lim_update_ext_cap_ie(mac_ctx, req_buffer->assoc_ie.addIEdata, + local_ie_buf, &local_ie_len)) { + if (local_ie_len < QDF_ARRAY_SIZE(req_buffer->assoc_ie.addIEdata)) { req_buffer->assoc_ie.length = local_ie_len; qdf_mem_copy(req_buffer->assoc_ie.addIEdata, From 975b4d339abc4a3acb9473cb1fc38fe0795403db Mon Sep 17 00:00:00 2001 From: qcabuildsw Date: Fri, 28 Oct 2016 17:10:57 -0700 Subject: [PATCH 2/6] Release 5.1.0.34B Release 5.1.0.34B Change-Id: I5923bf2aefcae4a1b4617cc4ab271307f59e4d0a CRs-Fixed: 688141 --- core/mac/inc/qwlan_version.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/mac/inc/qwlan_version.h b/core/mac/inc/qwlan_version.h index 88237f8aec48..40fe4da04249 100644 --- a/core/mac/inc/qwlan_version.h +++ b/core/mac/inc/qwlan_version.h @@ -41,9 +41,9 @@ #define QWLAN_VERSION_MAJOR 5 #define QWLAN_VERSION_MINOR 1 #define QWLAN_VERSION_PATCH 0 -#define QWLAN_VERSION_EXTRA "A" +#define QWLAN_VERSION_EXTRA "B" #define QWLAN_VERSION_BUILD 34 -#define QWLAN_VERSIONSTR "5.1.0.34A" +#define QWLAN_VERSIONSTR "5.1.0.34B" #endif /* QWLAN_VERSION_H */ From 2d57a0dd0e73fd286963c40e6382ff45c77fe208 Mon Sep 17 00:00:00 2001 From: Naveen Rawat Date: Fri, 21 Oct 2016 15:59:54 -0700 Subject: [PATCH 3/6] qcacld-3.0: Fix ext_caps IE in Probe Request sent due to HB Failure Pass addition scan IE to probe request function when generating probe request due to HB failure, otherwise Ext Cap IE values will not be consistent with other probe requests. Change-Id: I65ba2d5377f7c48d5344c5b4b9782e3c55f6635c CRs-Fixed: 1081117 --- core/mac/src/pe/lim/lim_link_monitoring_algo.c | 4 +++- core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c | 10 +++++----- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/core/mac/src/pe/lim/lim_link_monitoring_algo.c b/core/mac/src/pe/lim/lim_link_monitoring_algo.c index 9d7b9fe9d936..57f00e48abd3 100644 --- a/core/mac/src/pe/lim/lim_link_monitoring_algo.c +++ b/core/mac/src/pe/lim/lim_link_monitoring_algo.c @@ -491,7 +491,9 @@ void lim_handle_heart_beat_failure(tpAniSirGlobal mac_ctx, /* for searching AP, we don't include any more IE */ lim_send_probe_req_mgmt_frame(mac_ctx, &session->ssId, session->bssId, curr_chan, session->selfMacAddr, - session->dot11mode, 0, NULL); + session->dot11mode, + session->pLimJoinReq->addIEScan.length, + session->pLimJoinReq->addIEScan.addIEdata); } else { lim_log(mac_ctx, LOGW, FL("HB missed from AP on DFS chanel moving to passive")); diff --git a/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c b/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c index bd61bb43c4a0..ed7eb00abe27 100644 --- a/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c +++ b/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c @@ -1372,6 +1372,8 @@ lim_handle_sme_join_result(tpAniSirGlobal mac_ctx, * to SME */ lim_cleanup_rx_path(mac_ctx, sta_ds, session_entry); + qdf_mem_free(session_entry->pLimJoinReq); + session_entry->pLimJoinReq = NULL; /* Cleanup if add bss failed */ if (session_entry->add_bss_failed) { dph_delete_hash_entry(mac_ctx, @@ -1379,15 +1381,13 @@ lim_handle_sme_join_result(tpAniSirGlobal mac_ctx, &session_entry->dph.dphHashTable); goto error; } - qdf_mem_free(session_entry->pLimJoinReq); - session_entry->pLimJoinReq = NULL; return; } + qdf_mem_free(session_entry->pLimJoinReq); + session_entry->pLimJoinReq = NULL; } error: - qdf_mem_free(session_entry->pLimJoinReq); - session_entry->pLimJoinReq = NULL; - /* Delete teh session if JOIN failure occurred. */ + /* Delete the session if JOIN failure occurred. */ if (result_code != eSIR_SME_SUCCESS) { if (lim_set_link_state (mac_ctx, eSIR_LINK_DOWN_STATE, From cfc4cad7900c8fd6ac82110e38d30c39dfba04d6 Mon Sep 17 00:00:00 2001 From: qcabuildsw Date: Fri, 28 Oct 2016 17:43:03 -0700 Subject: [PATCH 4/6] Release 5.1.0.34C Release 5.1.0.34C Change-Id: I706e96ccc0193cf218a5ed3180947bb80c419aa9 CRs-Fixed: 688141 --- core/mac/inc/qwlan_version.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/mac/inc/qwlan_version.h b/core/mac/inc/qwlan_version.h index 40fe4da04249..4c74e7af57f0 100644 --- a/core/mac/inc/qwlan_version.h +++ b/core/mac/inc/qwlan_version.h @@ -41,9 +41,9 @@ #define QWLAN_VERSION_MAJOR 5 #define QWLAN_VERSION_MINOR 1 #define QWLAN_VERSION_PATCH 0 -#define QWLAN_VERSION_EXTRA "B" +#define QWLAN_VERSION_EXTRA "C" #define QWLAN_VERSION_BUILD 34 -#define QWLAN_VERSIONSTR "5.1.0.34B" +#define QWLAN_VERSIONSTR "5.1.0.34C" #endif /* QWLAN_VERSION_H */ From 9da8a5dee1b1dad88b399069f867e5ac1d623344 Mon Sep 17 00:00:00 2001 From: Jeff Johnson Date: Fri, 28 Oct 2016 16:34:04 -0700 Subject: [PATCH 5/6] qcacld-3.0: Avoid NULL pointer dereference in send_packetdump() In send_packetdump() the call to hdd_get_adapter_by_vdev() can return a NULL pointer if an adapter with the given vdev is not found. Add logic to validate the pointer before dereferencing it. Change-Id: I7dce5ed4debc43ef2f14d429e5651732377fe3e0 CRs-Fixed: 1083819 --- core/utils/logging/src/wlan_logging_sock_svc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/core/utils/logging/src/wlan_logging_sock_svc.c b/core/utils/logging/src/wlan_logging_sock_svc.c index cbd8c8f36219..f8886a86a9d2 100644 --- a/core/utils/logging/src/wlan_logging_sock_svc.c +++ b/core/utils/logging/src/wlan_logging_sock_svc.c @@ -1331,6 +1331,8 @@ static void send_packetdump(qdf_nbuf_t netbuf, uint8_t status, return; adapter = hdd_get_adapter_by_vdev(hdd_ctx, vdev_id); + if (!adapter) + return; /* Send packet dump only for STA interface */ if (adapter->device_mode != QDF_STA_MODE) From 7c2d0a0afece1c787e090069ab9465680fb315ee Mon Sep 17 00:00:00 2001 From: qcabuildsw Date: Fri, 28 Oct 2016 18:11:33 -0700 Subject: [PATCH 6/6] Release 5.1.0.34D Release 5.1.0.34D Change-Id: I245b923a6fe4239196587530d077b6e41e9191e4 CRs-Fixed: 688141 --- core/mac/inc/qwlan_version.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/mac/inc/qwlan_version.h b/core/mac/inc/qwlan_version.h index 4c74e7af57f0..6abb230e782b 100644 --- a/core/mac/inc/qwlan_version.h +++ b/core/mac/inc/qwlan_version.h @@ -41,9 +41,9 @@ #define QWLAN_VERSION_MAJOR 5 #define QWLAN_VERSION_MINOR 1 #define QWLAN_VERSION_PATCH 0 -#define QWLAN_VERSION_EXTRA "C" +#define QWLAN_VERSION_EXTRA "D" #define QWLAN_VERSION_BUILD 34 -#define QWLAN_VERSIONSTR "5.1.0.34C" +#define QWLAN_VERSIONSTR "5.1.0.34D" #endif /* QWLAN_VERSION_H */