From 46082ed4e3eada60f2dce5a43a818e4a3db9f2c4 Mon Sep 17 00:00:00 2001 From: Venkateswara Swamy Bandaru Date: Fri, 3 Jan 2020 16:44:15 +0530 Subject: [PATCH] qcacmn: Fix issue in RNR IE processing Fix RNR IE processing by correctly adjusting offsets. neighbour ap info field processing is present only at beginning of IE skip it only once. Change-Id: I05923e4ff9efa00aeed141b0cff8b62913622cf6 CRs-Fixed: 2592014 --- .../scan/dispatcher/src/wlan_scan_utils_api.c | 58 ++++++++----------- 1 file changed, 25 insertions(+), 33 deletions(-) diff --git a/umac/scan/dispatcher/src/wlan_scan_utils_api.c b/umac/scan/dispatcher/src/wlan_scan_utils_api.c index f9d23deaf6c3..bfbe4f3e9fc7 100644 --- a/umac/scan/dispatcher/src/wlan_scan_utils_api.c +++ b/umac/scan/dispatcher/src/wlan_scan_utils_api.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2017-2019 The Linux Foundation. All rights reserved. + * Copyright (c) 2017-2020 The Linux Foundation. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -598,17 +598,15 @@ util_scan_is_hidden_ssid(struct ie_ssid *ssid) static QDF_STATUS util_scan_update_rnr(struct rnr_bss_info *rnr, struct neighbor_ap_info_field *ap_info, - uint8_t **data) + uint8_t *data) { - uint16_t fieldtype; - uint8_t *tmp = *data; + uint8_t tbtt_info_length; - fieldtype = ap_info->tbtt_header.tbbt_info_fieldtype; + tbtt_info_length = ap_info->tbtt_header.tbtt_info_length; - switch (fieldtype) { + switch (tbtt_info_length) { case TBTT_NEIGHBOR_AP_OFFSET_ONLY: /* Dont store it skip*/ - *data = tmp + NEIGHBOR_AP_LEN; break; case TBTT_NEIGHBOR_AP_BSS_PARAM: @@ -618,51 +616,42 @@ util_scan_update_rnr(struct rnr_bss_info *rnr, case TBTT_NEIGHBOR_AP_SHORTSSID: rnr->channel_number = ap_info->channel_number; rnr->operating_class = ap_info->operting_class; - qdf_mem_copy(&rnr->short_ssid, &tmp[1], SHORT_SSID_LEN); - *data = tmp + NEIGHBOR_AP_LEN + SHORT_SSID_LEN; + qdf_mem_copy(&rnr->short_ssid, &data[1], SHORT_SSID_LEN); break; case TBTT_NEIGHBOR_AP_S_SSID_BSS_PARAM: rnr->channel_number = ap_info->channel_number; rnr->operating_class = ap_info->operting_class; - qdf_mem_copy(&rnr->short_ssid, &tmp[1], SHORT_SSID_LEN); - rnr->bss_params = tmp[5]; - *data = tmp + NEIGHBOR_AP_LEN + SHORT_SSID_LEN + BSS_PARAMS_LEN; + qdf_mem_copy(&rnr->short_ssid, &data[1], SHORT_SSID_LEN); + rnr->bss_params = data[5]; break; case TBTT_NEIGHBOR_AP_BSSID: rnr->channel_number = ap_info->channel_number; rnr->operating_class = ap_info->operting_class; - qdf_mem_copy(&rnr->bssid, &tmp[1], QDF_MAC_ADDR_SIZE); - *data = tmp + NEIGHBOR_AP_LEN + QDF_MAC_ADDR_SIZE; + qdf_mem_copy(&rnr->bssid, &data[1], QDF_MAC_ADDR_SIZE); break; case TBTT_NEIGHBOR_AP_BSSID_BSS_PARAM: rnr->channel_number = ap_info->channel_number; rnr->operating_class = ap_info->operting_class; - qdf_mem_copy(&rnr->bssid, &tmp[1], QDF_MAC_ADDR_SIZE); - rnr->bss_params = tmp[7]; - *data = tmp + NEIGHBOR_AP_LEN + QDF_MAC_ADDR_SIZE - + BSS_PARAMS_LEN; + qdf_mem_copy(&rnr->bssid, &data[1], QDF_MAC_ADDR_SIZE); + rnr->bss_params = data[7]; break; case TBTT_NEIGHBOR_AP_BSSSID_S_SSID: rnr->channel_number = ap_info->channel_number; rnr->operating_class = ap_info->operting_class; - qdf_mem_copy(&rnr->bssid, &tmp[1], QDF_MAC_ADDR_SIZE); - qdf_mem_copy(&rnr->short_ssid, &tmp[7], SHORT_SSID_LEN); - *data = tmp + NEIGHBOR_AP_LEN + QDF_MAC_ADDR_SIZE - + SHORT_SSID_LEN; + qdf_mem_copy(&rnr->bssid, &data[1], QDF_MAC_ADDR_SIZE); + qdf_mem_copy(&rnr->short_ssid, &data[7], SHORT_SSID_LEN); break; case TBTT_NEIGHBOR_AP_BSSID_S_SSID_BSS_PARAM: rnr->channel_number = ap_info->channel_number; rnr->operating_class = ap_info->operting_class; - qdf_mem_copy(&rnr->bssid, &tmp[1], QDF_MAC_ADDR_SIZE); - qdf_mem_copy(&rnr->short_ssid, &tmp[7], SHORT_SSID_LEN); - rnr->bss_params = tmp[11]; - *data = tmp + NEIGHBOR_AP_LEN + QDF_MAC_ADDR_SIZE - + SHORT_SSID_LEN + BSS_PARAMS_LEN; + qdf_mem_copy(&rnr->bssid, &data[1], QDF_MAC_ADDR_SIZE); + qdf_mem_copy(&rnr->short_ssid, &data[7], SHORT_SSID_LEN); + rnr->bss_params = data[11]; break; default: @@ -684,7 +673,7 @@ util_scan_parse_rnr_ie(struct scan_cache_entry *scan_entry, rnr_ie_len = ie->ie_len; data = (uint8_t *)ie + sizeof(struct ie_header); - while (data < (uint8_t *)ie + rnr_ie_len + 2) { + while (data < ((uint8_t *)ie + rnr_ie_len + 2)) { neighbor_ap_info = (struct neighbor_ap_info_field *)data; tbtt_count = neighbor_ap_info->tbtt_header.tbtt_info_count; tbtt_length = neighbor_ap_info->tbtt_header.tbtt_info_length; @@ -694,11 +683,14 @@ util_scan_parse_rnr_ie(struct scan_cache_entry *scan_entry, neighbor_ap_info->operting_class); scm_debug("tbtt_count %d, tbtt_length %d, fieldtype %d", tbtt_count, tbtt_length, fieldtype); - for (i = 0; i < (tbtt_count + 1) && i < MAX_RNR_BSS; i++) { - data = data + sizeof(struct neighbor_ap_info_field); - util_scan_update_rnr(&scan_entry->rnr.bss_info[i], - neighbor_ap_info, - &data); + data += sizeof(struct neighbor_ap_info_field); + for (i = 0; i < (tbtt_count + 1) ; i++) { + if (i < MAX_RNR_BSS) + util_scan_update_rnr( + &scan_entry->rnr.bss_info[i], + neighbor_ap_info, + data); + data += tbtt_length; } }