From 3d8e1f6a5545c5a9fa1b3eba7bdf61a38022aafb Mon Sep 17 00:00:00 2001
From: Jianmin Zhu <jianminz@codeaurora.org>
Date: Thu, 30 Sep 2021 15:31:10 +0800
Subject: [PATCH] qcacld-3.0: Fix array OOB for duplicate rate

Some IoT AP may have duplicate rates in supported rates and
extended rates in beacon, need filter them when populate peer 11a/11b
rates during connect/roaming, or array out of bound issue will happen.

Change-Id: I685e8c07ee147296bfa22742dad4210e7fa02c4a
CRs-Fixed: 3048142
---
 core/mac/src/pe/lim/lim_assoc_utils.c | 42 +++++++++++++++------------
 1 file changed, 24 insertions(+), 18 deletions(-)

diff --git a/core/mac/src/pe/lim/lim_assoc_utils.c b/core/mac/src/pe/lim/lim_assoc_utils.c
index e5fcc069b1d3..0b9af500c5b2 100644
--- a/core/mac/src/pe/lim/lim_assoc_utils.c
+++ b/core/mac/src/pe/lim/lim_assoc_utils.c
@@ -1655,7 +1655,6 @@ QDF_STATUS lim_populate_peer_rate_set(struct mac_context *mac,
 	for (i = 0; i < tempRateSet.numRates; i++) {
 		min = 0;
 		val = 0xff;
-		isArate = 0;
 		for (j = 0; (j < tempRateSet.numRates) &&
 		     (j < WLAN_SUPPORTED_RATES_IE_MAX_LEN); j++) {
 			if ((uint32_t)(tempRateSet.rate[j] & 0x7f) <
@@ -1664,8 +1663,22 @@ QDF_STATUS lim_populate_peer_rate_set(struct mac_context *mac,
 				min = j;
 			}
 		}
-		if (sirIsArate(tempRateSet.rate[min] & 0x7f))
+		if (sirIsArate(tempRateSet.rate[min] & 0x7f)) {
 			isArate = 1;
+		} else if (sirIsBrate(tempRateSet.rate[min] & 0x7f)) {
+			isArate = 0;
+		} else {
+			pe_debug("%d is neither 11a nor 11b rate",
+				 tempRateSet.rate[min]);
+			tempRateSet.rate[min] = 0xff;
+			continue;
+		}
+		if (tempRateSet.rate[min] == pRates->llaRates[aRateIndex] ||
+		    tempRateSet.rate[min] == pRates->llbRates[bRateIndex]) {
+			pe_debug("Duplicate rate: %d", tempRateSet.rate[min]);
+			tempRateSet.rate[min] = 0xff;
+			continue;
+		}
 		/*
 		 * HAL needs to know whether the rate is basic rate or not,
 		 * as it needs to update the response rate table accordingly.
@@ -1673,23 +1686,16 @@ QDF_STATUS lim_populate_peer_rate_set(struct mac_context *mac,
 		 * can be used for sending control frames. HAL updates the
 		 * response rate table whenever basic rate set is changed.
 		 */
-		if (basicOnly) {
-			if (tempRateSet.rate[min] & 0x80) {
-				if (isArate)
-					pRates->llaRates[aRateIndex++] =
-						tempRateSet.rate[min];
-				else
-					pRates->llbRates[bRateIndex++] =
-						tempRateSet.rate[min];
-			}
-		} else {
-			if (isArate)
-				pRates->llaRates[aRateIndex++] =
-					tempRateSet.rate[min];
-			else
-				pRates->llbRates[bRateIndex++] =
-					tempRateSet.rate[min];
+		if (basicOnly && !(tempRateSet.rate[min] & 0x80)) {
+			tempRateSet.rate[min] = 0xff;
+			continue;
 		}
+		if (isArate && aRateIndex < SIR_NUM_11A_RATES)
+			pRates->llaRates[aRateIndex++] =
+					tempRateSet.rate[min];
+		else if (bRateIndex < SIR_NUM_11B_RATES)
+			pRates->llbRates[bRateIndex++] =
+					tempRateSet.rate[min];
 		tempRateSet.rate[min] = 0xff;
 	}