A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 23:24:22 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix array OOB for duplicate rate

Browse source 
Some IoT AP may have duplicate rates in supported rates and
extended rates in beacon, need filter them when populate peer 11a/11b
rates during connect/roaming, or array out of bound issue will happen.

Change-Id: I685e8c07ee147296bfa22742dad4210e7fa02c4a
CRs-Fixed: 3048142
This commit is contained in:
Jianmin Zhu 2021-09-30 15:31:10 +08:00 • committed by Madan Koyyalamudi
commit 3d8e1f6a55
1 changed files with 23 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

42
core/mac/src/pe/lim/lim_assoc_utils.c
View file

@ -1655,7 +1655,6 @@ QDF_STATUS lim_populate_peer_rate_set(struct mac_context *mac,
for (i = 0; i < tempRateSet.numRates; i++) {
min = 0;
val = 0xff;
isArate = 0;
for (j = 0; (j < tempRateSet.numRates) &&
(j < WLAN_SUPPORTED_RATES_IE_MAX_LEN); j++) {
if ((uint32_t)(tempRateSet.rate[j] & 0x7f) <
@ -1664,8 +1663,22 @@ QDF_STATUS lim_populate_peer_rate_set(struct mac_context *mac,
min = j;
}
}
if (sirIsArate(tempRateSet.rate[min] & 0x7f))
if (sirIsArate(tempRateSet.rate[min] & 0x7f)) {
isArate = 1;
} else if (sirIsBrate(tempRateSet.rate[min] & 0x7f)) {
isArate = 0;
} else {
pe_debug("%d is neither 11a nor 11b rate",
tempRateSet.rate[min]);
tempRateSet.rate[min] = 0xff;
continue;
}
if (tempRateSet.rate[min] == pRates->llaRates[aRateIndex] ||
tempRateSet.rate[min] == pRates->llbRates[bRateIndex]) {
pe_debug("Duplicate rate: %d", tempRateSet.rate[min]);
tempRateSet.rate[min] = 0xff;
continue;
}
/*
* HAL needs to know whether the rate is basic rate or not,
* as it needs to update the response rate table accordingly.
@ -1673,23 +1686,16 @@ QDF_STATUS lim_populate_peer_rate_set(struct mac_context *mac,
* can be used for sending control frames. HAL updates the
* response rate table whenever basic rate set is changed.
*/
if (basicOnly) {
if (tempRateSet.rate[min] & 0x80) {
if (isArate)
pRates->llaRates[aRateIndex++] =
tempRateSet.rate[min];
else
pRates->llbRates[bRateIndex++] =
tempRateSet.rate[min];
}
} else {
if (isArate)
pRates->llaRates[aRateIndex++] =
tempRateSet.rate[min];
else
pRates->llbRates[bRateIndex++] =
tempRateSet.rate[min];
if (basicOnly && !(tempRateSet.rate[min] & 0x80)) {
tempRateSet.rate[min] = 0xff;
continue;
}
if (isArate && aRateIndex < SIR_NUM_11A_RATES)
pRates->llaRates[aRateIndex++] =
tempRateSet.rate[min];
else if (bRateIndex < SIR_NUM_11B_RATES)
pRates->llbRates[bRateIndex++] =
tempRateSet.rate[min];
tempRateSet.rate[min] = 0xff;
}