From 2a206c568a1053590be5eeea77f5df3e8fac6902 Mon Sep 17 00:00:00 2001
From: Sandeep Puligilla <spuligil@codeaurora.org>
Date: Thu, 25 May 2017 01:05:49 -0700
Subject: [PATCH] qcacld-3.0: Add NULL IE check

Beacons with NULL IE's are triggering crash
in framework.

Add condition check in WMA to drop beacons
with NULL IE.

Change-Id: Ie28cd513713668334a77a2e8f5f345d79f68fcb5
CRs-Fixed: 2047525
---
 core/wma/src/wma_mgmt.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c
index 97a765cb3d31..9eec633b9d66 100644
--- a/core/wma/src/wma_mgmt.c
+++ b/core/wma/src/wma_mgmt.c
@@ -3567,6 +3567,19 @@ int wma_form_rx_packet(qdf_nbuf_t buf,
 	rx_pkt->pkt_meta.sessionId =
 		(vdev_id == WMA_INVALID_VDEV_ID ? 0 : vdev_id);
 
+	if (mgt_type == IEEE80211_FC0_TYPE_MGT &&
+	    (mgt_subtype == IEEE80211_FC0_SUBTYPE_BEACON ||
+	     mgt_subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)) {
+		if (mgmt_rx_params->buf_len <=
+			(sizeof(struct ieee80211_frame) +
+			offsetof(struct wlan_bcn_frame, ie))) {
+			WMA_LOGD("Dropping frame from "MAC_ADDRESS_STR,
+				 MAC_ADDR_ARRAY(wh->i_addr3));
+			cds_pkt_return_packet(rx_pkt);
+			return -EINVAL;
+		}
+	}
+
 	if (wma_is_pkt_drop_candidate(wma_handle, wh->i_addr2, wh->i_addr3,
 					mgt_subtype)) {
 		cds_pkt_return_packet(rx_pkt);