From 61edca871f5d4e07b734b42526018bfc0449c9e4 Mon Sep 17 00:00:00 2001 From: Shwetha Goravanahalli Kemparaju Date: Mon, 25 Sep 2023 13:35:11 +0530 Subject: [PATCH] qcacmn: Fix OOB issue Changes to fix OOB issue seen util_scan_parse_beacon_frame. CRs-Fixed: 3582496 Change-Id: I53244be54d31e87b55d0b44ce94315c8001f417d --- .../cmn_defs/inc/wlan_cmn_ieee80211.h | 4 +++ .../scan/dispatcher/src/wlan_scan_utils_api.c | 25 +++++++++++++------ 2 files changed, 22 insertions(+), 7 deletions(-) diff --git a/umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h b/umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h index d519f3396ac1..f4ccb035f530 100644 --- a/umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h +++ b/umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h @@ -205,6 +205,10 @@ #define WLAN_MAX_HEOP_IE_LEN 16 #define WLAN_HEOP_OUI_TYPE "\x24" #define WLAN_HEOP_OUI_SIZE 1 +#define WLAN_MIN_HECAP_IE_LEN 22 +#define WLAN_MAX_HECAP_IE_LEN 55 +#define WLAN_HE_MCS_MAP_LEN 2 +#define WLAN_INVALID_RX_MCS_MAP 0xFFFF #define WLAN_HEOP_FIXED_PARAM_LENGTH 7 #define WLAN_HEOP_VHTOP_LENGTH 3 diff --git a/umac/scan/dispatcher/src/wlan_scan_utils_api.c b/umac/scan/dispatcher/src/wlan_scan_utils_api.c index b6deba111005..49be228eac36 100644 --- a/umac/scan/dispatcher/src/wlan_scan_utils_api.c +++ b/umac/scan/dispatcher/src/wlan_scan_utils_api.c @@ -789,6 +789,9 @@ util_scan_parse_extn_ie(struct scan_cache_entry *scan_params, scan_params->ie_list.srp = (uint8_t *)ie; break; case WLAN_EXTN_ELEMID_HECAP: + if ((extn_ie->ie_len < WLAN_MIN_HECAP_IE_LEN) || + (extn_ie->ie_len > WLAN_MAX_HECAP_IE_LEN)) + return QDF_STATUS_E_INVAL; scan_params->ie_list.hecap = (uint8_t *)ie; break; case WLAN_EXTN_ELEMID_HEOP: @@ -1317,28 +1320,36 @@ static int util_scan_scm_calc_nss_supported_by_ap( { struct htcap_cmn_ie *htcap; struct wlan_ie_vhtcaps *vhtcaps; - struct wlan_ie_hecaps *hecaps; + uint8_t *he_cap; + uint8_t *end_ptr = NULL; uint16_t rx_mcs_map = 0; + uint8_t *mcs_map_offset; htcap = (struct htcap_cmn_ie *) util_scan_entry_htcap(scan_params); vhtcaps = (struct wlan_ie_vhtcaps *) util_scan_entry_vhtcap(scan_params); - hecaps = (struct wlan_ie_hecaps *) - util_scan_entry_hecap(scan_params); + he_cap = util_scan_entry_hecap(scan_params); - if (hecaps) { + if (he_cap) { /* Using rx mcs map related to 80MHz or lower as in some * cases higher mcs may suuport lesser NSS than that * of lowe mcs. Thus giving max NSS capability. */ - rx_mcs_map = - qdf_cpu_to_le16(hecaps->mcs_bw_map[0].rx_mcs_map); + end_ptr = he_cap + he_cap[1] + sizeof(struct ie_header); + mcs_map_offset = (he_cap + sizeof(struct extn_ie_header) + + WLAN_HE_MACCAP_LEN + WLAN_HE_PHYCAP_LEN); + if ((mcs_map_offset + WLAN_HE_MCS_MAP_LEN) <= end_ptr) { + rx_mcs_map = *(uint16_t *)mcs_map_offset; + } else { + rx_mcs_map = WLAN_INVALID_RX_MCS_MAP; + scm_debug("mcs_map_offset exceeds he cap len"); + } } else if (vhtcaps) { rx_mcs_map = vhtcaps->rx_mcs_map; } - if (hecaps || vhtcaps) { + if (he_cap || vhtcaps) { if ((rx_mcs_map & 0xC000) != 0xC000) return 8;