From 2ad401a79d247aaab28d044f3b83d2dacdbf3e77 Mon Sep 17 00:00:00 2001 From: Sreelakshmi Konamki Date: Wed, 2 Dec 2015 18:13:22 +0530 Subject: [PATCH] qcacld-3.0: Make data length as zero whenever we free the data qcacld-2.0 to qcacld-3.0 propagation In limSendSmeJoinReassocRsp API, assoc req, assoc rsp, ricData, tspecIes are sent to SME layer if corresponding pointer in psessionEntry is not NULL. There is bug here where the pointer is NULL but the length is non zero. Because of this data is copied at incorrect offset and data at SME layer is not at right offset leading to corrupted IE in next re-assoc request. Fix this by making length as zero whenever we free the data. Change-Id: I4ba4ff49e56bc2f2758d869eae8ff9370b0c0489 CRs-Fixed: 932712 --- .../src/pe/lim/lim_process_assoc_rsp_frame.c | 3 ++ .../mac/src/pe/lim/lim_process_beacon_frame.c | 1 + .../src/pe/lim/lim_process_probe_rsp_frame.c | 1 + .../src/pe/lim/lim_send_management_frames.c | 1 + .../src/pe/lim/lim_send_sme_rsp_messages.c | 39 ++++++++++++------- core/mac/src/pe/lim/lim_session.c | 3 ++ 6 files changed, 34 insertions(+), 14 deletions(-) diff --git a/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c b/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c index a73fa87a22fd..be37a64b9232 100644 --- a/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c +++ b/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c @@ -381,6 +381,7 @@ static void lim_update_ric_data(tpAniSirGlobal mac_ctx, if (session_entry->ricData != NULL) { cdf_mem_free(session_entry->ricData); session_entry->ricData = NULL; + session_entry->RICDataLen = 0; } if (assoc_rsp->ricPresent) { session_entry->RICDataLen = @@ -429,6 +430,7 @@ static void lim_update_ese_tspec(tpAniSirGlobal mac_ctx, if (session_entry->tspecIes != NULL) { cdf_mem_free(session_entry->tspecIes); session_entry->tspecIes = NULL; + session_entry->tspecLen = 0; } if (assoc_rsp->tspecPresent) { lim_log(mac_ctx, LOG1, FL("Tspec EID present in assoc rsp")); @@ -745,6 +747,7 @@ lim_process_assoc_rsp_frame(tpAniSirGlobal mac_ctx, "and setting NULL")); cdf_mem_free(session_entry->assocRsp); session_entry->assocRsp = NULL; + session_entry->assocRspLen = 0; } session_entry->assocRsp = cdf_mem_malloc(frame_len); diff --git a/core/mac/src/pe/lim/lim_process_beacon_frame.c b/core/mac/src/pe/lim/lim_process_beacon_frame.c index 18c05fd653f4..6d8075149a71 100644 --- a/core/mac/src/pe/lim/lim_process_beacon_frame.c +++ b/core/mac/src/pe/lim/lim_process_beacon_frame.c @@ -150,6 +150,7 @@ lim_process_beacon_frame(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info, if (session->beacon != NULL) { cdf_mem_free(session->beacon); session->beacon = NULL; + session->bcnLen = 0; } session->bcnLen = WMA_GET_RX_PAYLOAD_LEN(rx_pkt_info); session->beacon = cdf_mem_malloc(session->bcnLen); diff --git a/core/mac/src/pe/lim/lim_process_probe_rsp_frame.c b/core/mac/src/pe/lim/lim_process_probe_rsp_frame.c index 0096b48cab36..1cfd74340774 100644 --- a/core/mac/src/pe/lim/lim_process_probe_rsp_frame.c +++ b/core/mac/src/pe/lim/lim_process_probe_rsp_frame.c @@ -161,6 +161,7 @@ lim_process_probe_rsp_frame(tpAniSirGlobal mac_ctx, uint8_t *rx_Packet_info, if (session_entry->beacon != NULL) { cdf_mem_free(session_entry->beacon); session_entry->beacon = NULL; + session_entry->bcnLen = 0; } session_entry->bcnLen = WMA_GET_RX_PAYLOAD_LEN(rx_Packet_info); diff --git a/core/mac/src/pe/lim/lim_send_management_frames.c b/core/mac/src/pe/lim/lim_send_management_frames.c index 50884de03e6f..e33d95bf894a 100644 --- a/core/mac/src/pe/lim/lim_send_management_frames.c +++ b/core/mac/src/pe/lim/lim_send_management_frames.c @@ -2358,6 +2358,7 @@ lim_send_reassoc_req_with_ft_ies_mgmt_frame(tpAniSirGlobal mac_ctx, if (NULL != pe_session->assocReq) { cdf_mem_free(pe_session->assocReq); pe_session->assocReq = NULL; + pe_session->assocReqLen = 0; } if (ft_ies_length) { pe_session->assocReq = cdf_mem_malloc(ft_ies_length); diff --git a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c index 326dfc7576a0..470f11958ec1 100644 --- a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c +++ b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c @@ -271,48 +271,53 @@ static void lim_handle_join_rsp_status(tpAniSirGlobal mac_ctx, sme_join_rsp->beaconLength); cdf_mem_free(session_entry->beacon); session_entry->beacon = NULL; + session_entry->bcnLen = 0; #ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG lim_log(mac_ctx, LOG1, FL("Beacon=%d"), - session_entry->bcnLen); + sme_join_rsp->beaconLength); #endif } if (session_entry->assocReq != NULL) { sme_join_rsp->assocReqLength = session_entry->assocReqLen; cdf_mem_copy(sme_join_rsp->frames + - session_entry->bcnLen, session_entry->assocReq, + sme_join_rsp->beaconLength, + session_entry->assocReq, sme_join_rsp->assocReqLength); cdf_mem_free(session_entry->assocReq); session_entry->assocReq = NULL; + session_entry->assocReqLen = 0; #ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG lim_log(mac_ctx, LOG1, FL("AssocReq=%d"), - session_entry->assocReqLen); + sme_join_rsp->assocReqLength); #endif } if (session_entry->assocRsp != NULL) { sme_join_rsp->assocRspLength = session_entry->assocRspLen; cdf_mem_copy(sme_join_rsp->frames + - session_entry->bcnLen + - session_entry->assocReqLen, + sme_join_rsp->beaconLength + + sme_join_rsp->assocReqLength, session_entry->assocRsp, sme_join_rsp->assocRspLength); cdf_mem_free(session_entry->assocRsp); session_entry->assocRsp = NULL; + session_entry->assocRspLen = 0; } #ifdef WLAN_FEATURE_VOWIFI_11R if (session_entry->ricData != NULL) { sme_join_rsp->parsedRicRspLen = session_entry->RICDataLen; cdf_mem_copy(sme_join_rsp->frames + - session_entry->bcnLen + - session_entry->assocReqLen + - session_entry->assocRspLen, + sme_join_rsp->beaconLength + + sme_join_rsp->assocReqLength + + sme_join_rsp->assocRspLength, session_entry->ricData, sme_join_rsp->parsedRicRspLen); cdf_mem_free(session_entry->ricData); session_entry->ricData = NULL; + session_entry->RICDataLen = 0; lim_log(mac_ctx, LOG1, FL("RicLength=%d"), sme_join_rsp->parsedRicRspLen); } @@ -322,22 +327,23 @@ static void lim_handle_join_rsp_status(tpAniSirGlobal mac_ctx, sme_join_rsp->tspecIeLen = session_entry->tspecLen; cdf_mem_copy(sme_join_rsp->frames + - session_entry->bcnLen + - session_entry->assocReqLen + - session_entry->assocRspLen + - session_entry->RICDataLen, + sme_join_rsp->beaconLength + + sme_join_rsp->assocReqLength + + sme_join_rsp->assocRspLength + + sme_join_rsp->parsedRicRspLen, session_entry->tspecIes, sme_join_rsp->tspecIeLen); cdf_mem_free(session_entry->tspecIes); session_entry->tspecIes = NULL; + session_entry->tspecLen = 0; lim_log(mac_ctx, LOG1, FL("ESE-TspecLen=%d"), - session_entry->tspecLen); + sme_join_rsp->tspecIeLen); } #endif sme_join_rsp->aid = session_entry->limAID; #ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG lim_log(mac_ctx, LOG1, FL("AssocRsp=%d"), - session_entry->assocRspLen); + sme_join_rsp->assocRspLength); #endif sme_join_rsp->vht_channel_width = session_entry->ch_width; @@ -367,25 +373,30 @@ static void lim_handle_join_rsp_status(tpAniSirGlobal mac_ctx, if (session_entry->beacon != NULL) { cdf_mem_free(session_entry->beacon); session_entry->beacon = NULL; + session_entry->bcnLen = 0; } if (session_entry->assocReq != NULL) { cdf_mem_free(session_entry->assocReq); session_entry->assocReq = NULL; + session_entry->assocReqLen = 0; } if (session_entry->assocRsp != NULL) { cdf_mem_free(session_entry->assocRsp); session_entry->assocRsp = NULL; + session_entry->assocRspLen = 0; } #ifdef WLAN_FEATURE_VOWIFI_11R if (session_entry->ricData != NULL) { cdf_mem_free(session_entry->ricData); session_entry->ricData = NULL; + session_entry->RICDataLen = 0; } #endif #ifdef FEATURE_WLAN_ESE if (session_entry->tspecIes != NULL) { cdf_mem_free(session_entry->tspecIes); session_entry->tspecIes = NULL; + session_entry->tspecLen = 0; } #endif } diff --git a/core/mac/src/pe/lim/lim_session.c b/core/mac/src/pe/lim/lim_session.c index 5e7f1cf6e665..2c245e94de8d 100644 --- a/core/mac/src/pe/lim/lim_session.c +++ b/core/mac/src/pe/lim/lim_session.c @@ -601,16 +601,19 @@ void pe_delete_session(tpAniSirGlobal mac_ctx, tpPESession session) if (session->beacon != NULL) { cdf_mem_free(session->beacon); session->beacon = NULL; + session->bcnLen = 0; } if (session->assocReq != NULL) { cdf_mem_free(session->assocReq); session->assocReq = NULL; + session->assocReqLen = 0; } if (session->assocRsp != NULL) { cdf_mem_free(session->assocRsp); session->assocRsp = NULL; + session->assocRspLen = 0; } if (session->parsedAssocReq != NULL) {