diff --git a/core/hdd/src/wlan_hdd_ext_scan.c b/core/hdd/src/wlan_hdd_ext_scan.c index 5f0d842908c1..c3b05cab0f5d 100644 --- a/core/hdd/src/wlan_hdd_ext_scan.c +++ b/core/hdd/src/wlan_hdd_ext_scan.c @@ -4022,6 +4022,13 @@ int wlan_hdd_cfg80211_set_epno_list(struct wiphy *wiphy, return ret; } +#define PARAM_ID QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ID +#define PARAM_REALM QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_REALM +#define PARAM_ROAM_ID \ + QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ROAM_CNSRTM_ID +#define PARAM_ROAM_PLMN \ + QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ROAM_PLMN + /** * hdd_extscan_passpoint_fill_network_list() - passpoint fill network list * @hddctx: HDD context @@ -4040,7 +4047,8 @@ static int hdd_extscan_passpoint_fill_network_list( { struct nlattr *network[QCA_WLAN_VENDOR_ATTR_PNO_MAX + 1]; struct nlattr *networks; - int rem1, len; + int rem1; + size_t len; uint8_t index; uint32_t expected_networks; @@ -4070,49 +4078,47 @@ static int hdd_extscan_passpoint_fill_network_list( } /* Parse and fetch identifier */ - if (!network[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ID]) { + if (!network[PARAM_ID]) { hdd_err("attr passpoint id failed"); return -EINVAL; } - req_msg->networks[index].id = nla_get_u32( - network[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ID]); + req_msg->networks[index].id = nla_get_u32(network[PARAM_ID]); hdd_debug("Id %u", req_msg->networks[index].id); /* Parse and fetch realm */ - if (!network[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_REALM]) { + if (!network[PARAM_REALM]) { hdd_err("attr realm failed"); return -EINVAL; } - len = nla_len( - network[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_REALM]); - if (len < 0 || len > SIR_PASSPOINT_REALM_LEN) { - hdd_err("Invalid realm size %d", len); + len = nla_strlcpy(req_msg->networks[index].realm, + network[PARAM_REALM], + SIR_PASSPOINT_REALM_LEN); + /* Don't send partial realm to firmware */ + if (len >= SIR_PASSPOINT_REALM_LEN) { + hdd_err("user passed invalid realm, len:%zu", len); return -EINVAL; } - qdf_mem_copy(req_msg->networks[index].realm, - nla_data(network[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_REALM]), - len); - hdd_debug("realm len %d", len); + hdd_debug("realm: %s", req_msg->networks[index].realm); /* Parse and fetch roaming consortium ids */ - if (!network[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ROAM_CNSRTM_ID]) { + if (!network[PARAM_ROAM_ID]) { hdd_err("attr roaming consortium ids failed"); return -EINVAL; } nla_memcpy(&req_msg->networks[index].roaming_consortium_ids, - network[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ROAM_CNSRTM_ID], - sizeof(req_msg->networks[0].roaming_consortium_ids)); + network[PARAM_ROAM_ID], + sizeof(req_msg->networks[0].roaming_consortium_ids)); hdd_debug("roaming consortium ids"); /* Parse and fetch plmn */ - if (!network[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ROAM_PLMN]) { + if (!network[PARAM_ROAM_PLMN]) { hdd_err("attr plmn failed"); return -EINVAL; } nla_memcpy(&req_msg->networks[index].plmn, - network[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ROAM_PLMN], - SIR_PASSPOINT_PLMN_LEN); + network[PARAM_ROAM_PLMN], + SIR_PASSPOINT_PLMN_LEN); hdd_debug("plmn %02x:%02x:%02x)", req_msg->networks[index].plmn[0], req_msg->networks[index].plmn[1], @@ -4347,6 +4353,11 @@ int wlan_hdd_cfg80211_reset_passpoint_list(struct wiphy *wiphy, return ret; } +#undef PARAM_ID +#undef PARAM_REALM +#undef PARAM_ROAM_ID +#undef PARAM_ROAM_PLMN + /** * wlan_hdd_init_completion_extwow() - Initialize ext wow variable * @hdd_ctx: Global HDD context