From 1caffee64c3763494b4ad88f6c92a35dc0508923 Mon Sep 17 00:00:00 2001 From: Kabilan Kannan Date: Wed, 1 Nov 2017 20:58:23 -0700 Subject: [PATCH] qcacmn: Fix the invalid memory access issue in TDLS Additional IE's in the TDLS management request is not populated correctly and it causes invalid memory access and system crash. Populate the additional TDLS IE's in correct order. Change-Id: I1c65f04c3b0e134dc4854e3f16022c887e8ce7c0 CRs-Fixed: 2136739 --- umac/tdls/dispatcher/inc/wlan_tdls_public_structs.h | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/umac/tdls/dispatcher/inc/wlan_tdls_public_structs.h b/umac/tdls/dispatcher/inc/wlan_tdls_public_structs.h index 712a81dac8aa..936623c0eb29 100644 --- a/umac/tdls/dispatcher/inc/wlan_tdls_public_structs.h +++ b/umac/tdls/dispatcher/inc/wlan_tdls_public_structs.h @@ -930,9 +930,8 @@ struct tdls_event_notify { * @dialog: dialog token used in the frame. * @status_code: status to be incuded in the frame * @responder: Tdls request type - * @len: lenght of additional Ies * @peer_capability: peer cpabilities - * @len: lenght of additional Ies + * @len: length of additional Ies * @buf: additional IEs to be included */ struct tdls_send_mgmt { @@ -944,7 +943,7 @@ struct tdls_send_mgmt { uint32_t peer_capability; uint8_t len; /* Variable length, do not add anything after this */ - uint8_t *buf; + uint8_t buf[]; }; /** @@ -975,6 +974,9 @@ struct tdls_validate_action_req { * @chk_frame: frame validation structure * @session_id: session id * @vdev_id: vdev id + * @cmd_buf: cmd buffer + * @len: length of the frame + * @use_default_ac: access category * @tdls_mgmt: tdls managment */ struct tdls_action_frame_request { @@ -984,8 +986,9 @@ struct tdls_action_frame_request { uint8_t vdev_id; const uint8_t *cmd_buf; uint8_t len; - struct tdls_send_mgmt tdls_mgmt; bool use_default_ac; + /* Variable length, do not add anything after this */ + struct tdls_send_mgmt tdls_mgmt; }; /**