A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 08:36:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix underflow issue of beacon length

Browse source 
A validation check has been added to ensure
beacon length is not less than
(bcn->noa_sub_ie_len + sizeof(struct p2p_ie)),
preventing underflow issues.

Change-Id: I924a3ebf4a0749d5a4c56b36878765fcf46440a4
CRs-Fixed: 4166530
This commit is contained in:
Dharmendra Tiwari 2025-05-12 08:00:40 -07:00 • committed by rjesadiy
commit 4117e36cb8
1 changed files with 14 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

20
core/wma/src/wma_power.c
View file

@ -1,6 +1,6 @@
/*
* Copyright (c) 2013-2020 The Linux Foundation. All rights reserved.
* Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*
* Permission to use, copy, modify, and/or distribute this software for
* any purpose with or without fee is hereby granted, provided that the
@ -1171,20 +1171,28 @@ static void wma_update_beacon_noa_ie(struct beacon_info *bcn,
/* TODO: Assuming p2p noa ie is last ie in the beacon */
qdf_mem_zero(bcn->noa_ie, (bcn->noa_sub_ie_len +
sizeof(struct p2p_ie)));
bcn->len -= (bcn->noa_sub_ie_len +
sizeof(struct p2p_ie));
if (bcn->len < (bcn->noa_sub_ie_len +
sizeof(struct p2p_ie)))
bcn->len = 0;
else
bcn->len -= (bcn->noa_sub_ie_len +
sizeof(struct p2p_ie));
bcn->noa_ie = NULL;
bcn->noa_sub_ie_len = 0;
}
wma_debug("No need to update NoA");
return;
}
if (bcn->noa_sub_ie_len && bcn->noa_ie) {
if (bcn->len < (bcn->noa_sub_ie_len + sizeof(struct p2p_ie)))
bcn->len = 0;
else
bcn->len -= (bcn->noa_sub_ie_len +
sizeof(struct p2p_ie));
/* NoA present in previous beacon, update it */
wma_debug("NoA present in previous beacon, update the NoA IE, bcn->len %u bcn->noa_sub_ie_len %u",
bcn->len, bcn->noa_sub_ie_len);
bcn->len -= (bcn->noa_sub_ie_len + sizeof(struct p2p_ie));
bcn->len, bcn->noa_sub_ie_len);
qdf_mem_zero(bcn->noa_ie,
(bcn->noa_sub_ie_len + sizeof(struct p2p_ie)));
} else { /* NoA is not present in previous beacon */