A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Add checks for the assoc req/res lengths

Browse source 
In some case assos req/res length can be less than their respective
fixed fields due to which they get assigned to negative value
but as they are unsigned variable these req/res lengths gets convert
to large positive values. So during page memory allocation for these
lengths, page memory allocation failure happens.

To address the above issue add checks for both assoc req/res lenghts
before calculating the value for them.

Change-Id: Iff404e72420b27bc2a467a25fe530f135ee97c91
CRs-Fixed: 2903644
This commit is contained in:
Abdul Muqtadeer Ahmed 2021-04-07 21:47:27 +05:30 • committed by snandini
commit 6492f6c767
1 changed files with 12 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

16
core/hdd/src/wlan_hdd_assoc.c
View file

@ -3221,7 +3221,9 @@ hdd_association_completion_handler(struct hdd_adapter *adapter,
(u8 *) (roam_info->pbFrames +
roam_info->nBeaconLength +
roam_info->nAssocReqLength);
if (assoc_rsp) {
if (assoc_rsp &&
roam_info->nAssocRspLength >
ASSOC_RSP_IES_OFFSET) {
/*
* assoc_rsp needs to point to the IEs
*/
@ -3240,7 +3242,9 @@ hdd_association_completion_handler(struct hdd_adapter *adapter,
assoc_req = (u8 *) (roam_info->pbFrames +
roam_info->nBeaconLength);
if (assoc_req) {
if (!ft_carrier_on) {
if (!ft_carrier_on &&
roam_info->nAssocReqLength >
ASSOC_REQ_IES_OFFSET) {
/*
* assoc_req needs to point to
* the IEs
@ -3596,7 +3600,9 @@ hdd_association_completion_handler(struct hdd_adapter *adapter,
assoc_req =
(u8 *)(roam_info->pbFrames +
roam_info->nBeaconLength);
if (assoc_req) {
if (assoc_req &&
roam_info->nAssocReqLength >
ASSOC_REQ_IES_OFFSET) {
/*
* assoc_req needs to point to
* the IEs
@ -3615,7 +3621,9 @@ hdd_association_completion_handler(struct hdd_adapter *adapter,
(u8 *)(roam_info->pbFrames +
roam_info->nBeaconLength +
roam_info->nAssocReqLength);
if (assoc_rsp) {
if (assoc_rsp &&
roam_info->nAssocRspLength >
ASSOC_RSP_IES_OFFSET) {
/*
* assoc_rsp needs to point to the IEs
*/