A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 16:46:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Make data length as zero whenever we free the data

Browse source 
qcacld-2.0 to qcacld-3.0 propagation

In limSendSmeJoinReassocRsp API, assoc req, assoc rsp, ricData, tspecIes
are sent to SME layer if corresponding pointer in psessionEntry is
not NULL. There is bug here where the pointer is NULL but the length is
non zero. Because of this data is copied at incorrect offset and data
at SME layer is not at right offset leading to corrupted IE in
next re-assoc request.

Fix this by making length as zero whenever we free the data.

Change-Id: I4ba4ff49e56bc2f2758d869eae8ff9370b0c0489
CRs-Fixed: 932712
This commit is contained in:
Sreelakshmi Konamki 2015-12-02 18:13:22 +05:30 • committed by Akash Patel
commit 2ad401a79d
6 changed files with 34 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

3
core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c
View file

@ -381,6 +381,7 @@ static void lim_update_ric_data(tpAniSirGlobal mac_ctx,
if (session_entry->ricData != NULL) {
cdf_mem_free(session_entry->ricData);
session_entry->ricData = NULL;
session_entry->RICDataLen = 0;
}
if (assoc_rsp->ricPresent) {
session_entry->RICDataLen =
@ -429,6 +430,7 @@ static void lim_update_ese_tspec(tpAniSirGlobal mac_ctx,
if (session_entry->tspecIes != NULL) {
cdf_mem_free(session_entry->tspecIes);
session_entry->tspecIes = NULL;
session_entry->tspecLen = 0;
}
if (assoc_rsp->tspecPresent) {
lim_log(mac_ctx, LOG1, FL("Tspec EID present in assoc rsp"));
@ -745,6 +747,7 @@ lim_process_assoc_rsp_frame(tpAniSirGlobal mac_ctx,
"and setting NULL"));
cdf_mem_free(session_entry->assocRsp);
session_entry->assocRsp = NULL;
session_entry->assocRspLen = 0;
}
session_entry->assocRsp = cdf_mem_malloc(frame_len);

1
core/mac/src/pe/lim/lim_process_beacon_frame.c
View file

@ -150,6 +150,7 @@ lim_process_beacon_frame(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info,
if (session->beacon != NULL) {
cdf_mem_free(session->beacon);
session->beacon = NULL;
session->bcnLen = 0;
}
session->bcnLen = WMA_GET_RX_PAYLOAD_LEN(rx_pkt_info);
session->beacon = cdf_mem_malloc(session->bcnLen);

1
core/mac/src/pe/lim/lim_process_probe_rsp_frame.c
View file

@ -161,6 +161,7 @@ lim_process_probe_rsp_frame(tpAniSirGlobal mac_ctx, uint8_t *rx_Packet_info,
if (session_entry->beacon != NULL) {
cdf_mem_free(session_entry->beacon);
session_entry->beacon = NULL;
session_entry->bcnLen = 0;
}
session_entry->bcnLen =
WMA_GET_RX_PAYLOAD_LEN(rx_Packet_info);

1
core/mac/src/pe/lim/lim_send_management_frames.c
View file

@ -2358,6 +2358,7 @@ lim_send_reassoc_req_with_ft_ies_mgmt_frame(tpAniSirGlobal mac_ctx,
if (NULL != pe_session->assocReq) {
cdf_mem_free(pe_session->assocReq);
pe_session->assocReq = NULL;
pe_session->assocReqLen = 0;
}
if (ft_ies_length) {
pe_session->assocReq = cdf_mem_malloc(ft_ies_length);

39
core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
View file

@ -271,48 +271,53 @@ static void lim_handle_join_rsp_status(tpAniSirGlobal mac_ctx,
sme_join_rsp->beaconLength);
cdf_mem_free(session_entry->beacon);
session_entry->beacon = NULL;
session_entry->bcnLen = 0;
#ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
lim_log(mac_ctx, LOG1, FL("Beacon=%d"),
session_entry->bcnLen);
sme_join_rsp->beaconLength);
#endif
}
if (session_entry->assocReq != NULL) {
sme_join_rsp->assocReqLength =
session_entry->assocReqLen;
cdf_mem_copy(sme_join_rsp->frames +
session_entry->bcnLen, session_entry->assocReq,
sme_join_rsp->beaconLength,
session_entry->assocReq,
sme_join_rsp->assocReqLength);
cdf_mem_free(session_entry->assocReq);
session_entry->assocReq = NULL;
session_entry->assocReqLen = 0;
#ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
lim_log(mac_ctx,
LOG1, FL("AssocReq=%d"),
session_entry->assocReqLen);
sme_join_rsp->assocReqLength);
#endif
}
if (session_entry->assocRsp != NULL) {
sme_join_rsp->assocRspLength =
session_entry->assocRspLen;
cdf_mem_copy(sme_join_rsp->frames +
session_entry->bcnLen +
session_entry->assocReqLen,
sme_join_rsp->beaconLength +
sme_join_rsp->assocReqLength,
session_entry->assocRsp,
sme_join_rsp->assocRspLength);
cdf_mem_free(session_entry->assocRsp);
session_entry->assocRsp = NULL;
session_entry->assocRspLen = 0;
}
#ifdef WLAN_FEATURE_VOWIFI_11R
if (session_entry->ricData != NULL) {
sme_join_rsp->parsedRicRspLen =
session_entry->RICDataLen;
cdf_mem_copy(sme_join_rsp->frames +
session_entry->bcnLen +
session_entry->assocReqLen +
session_entry->assocRspLen,
sme_join_rsp->beaconLength +
sme_join_rsp->assocReqLength +
sme_join_rsp->assocRspLength,
session_entry->ricData,
sme_join_rsp->parsedRicRspLen);
cdf_mem_free(session_entry->ricData);
session_entry->ricData = NULL;
session_entry->RICDataLen = 0;
lim_log(mac_ctx, LOG1, FL("RicLength=%d"),
sme_join_rsp->parsedRicRspLen);
}
@ -322,22 +327,23 @@ static void lim_handle_join_rsp_status(tpAniSirGlobal mac_ctx,
sme_join_rsp->tspecIeLen =
session_entry->tspecLen;
cdf_mem_copy(sme_join_rsp->frames +
session_entry->bcnLen +
session_entry->assocReqLen +
session_entry->assocRspLen +
session_entry->RICDataLen,
sme_join_rsp->beaconLength +
sme_join_rsp->assocReqLength +
sme_join_rsp->assocRspLength +
sme_join_rsp->parsedRicRspLen,
session_entry->tspecIes,
sme_join_rsp->tspecIeLen);
cdf_mem_free(session_entry->tspecIes);
session_entry->tspecIes = NULL;
session_entry->tspecLen = 0;
lim_log(mac_ctx, LOG1, FL("ESE-TspecLen=%d"),
session_entry->tspecLen);
sme_join_rsp->tspecIeLen);
}
#endif
sme_join_rsp->aid = session_entry->limAID;
#ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
lim_log(mac_ctx, LOG1, FL("AssocRsp=%d"),
session_entry->assocRspLen);
sme_join_rsp->assocRspLength);
#endif
sme_join_rsp->vht_channel_width =
session_entry->ch_width;
@ -367,25 +373,30 @@ static void lim_handle_join_rsp_status(tpAniSirGlobal mac_ctx,
if (session_entry->beacon != NULL) {
cdf_mem_free(session_entry->beacon);
session_entry->beacon = NULL;
session_entry->bcnLen = 0;
}
if (session_entry->assocReq != NULL) {
cdf_mem_free(session_entry->assocReq);
session_entry->assocReq = NULL;
session_entry->assocReqLen = 0;
}
if (session_entry->assocRsp != NULL) {
cdf_mem_free(session_entry->assocRsp);
session_entry->assocRsp = NULL;
session_entry->assocRspLen = 0;
}
#ifdef WLAN_FEATURE_VOWIFI_11R
if (session_entry->ricData != NULL) {
cdf_mem_free(session_entry->ricData);
session_entry->ricData = NULL;
session_entry->RICDataLen = 0;
}
#endif
#ifdef FEATURE_WLAN_ESE
if (session_entry->tspecIes != NULL) {
cdf_mem_free(session_entry->tspecIes);
session_entry->tspecIes = NULL;
session_entry->tspecLen = 0;
}
#endif
}

3
core/mac/src/pe/lim/lim_session.c
View file

@ -601,16 +601,19 @@ void pe_delete_session(tpAniSirGlobal mac_ctx, tpPESession session)
if (session->beacon != NULL) {
cdf_mem_free(session->beacon);
session->beacon = NULL;
session->bcnLen = 0;
}
if (session->assocReq != NULL) {
cdf_mem_free(session->assocReq);
session->assocReq = NULL;
session->assocReqLen = 0;
}
if (session->assocRsp != NULL) {
cdf_mem_free(session->assocRsp);
session->assocRsp = NULL;
session->assocRspLen = 0;
}
if (session->parsedAssocReq != NULL) {