From 6492f6c7679af25eb269de5983663eedae326c7f Mon Sep 17 00:00:00 2001 From: Abdul Muqtadeer Ahmed Date: Wed, 7 Apr 2021 21:47:27 +0530 Subject: [PATCH] qcacld-3.0: Add checks for the assoc req/res lengths In some case assos req/res length can be less than their respective fixed fields due to which they get assigned to negative value but as they are unsigned variable these req/res lengths gets convert to large positive values. So during page memory allocation for these lengths, page memory allocation failure happens. To address the above issue add checks for both assoc req/res lenghts before calculating the value for them. Change-Id: Iff404e72420b27bc2a467a25fe530f135ee97c91 CRs-Fixed: 2903644 --- core/hdd/src/wlan_hdd_assoc.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/core/hdd/src/wlan_hdd_assoc.c b/core/hdd/src/wlan_hdd_assoc.c index bb6c826e7b8a..856f26061f77 100644 --- a/core/hdd/src/wlan_hdd_assoc.c +++ b/core/hdd/src/wlan_hdd_assoc.c @@ -3221,7 +3221,9 @@ hdd_association_completion_handler(struct hdd_adapter *adapter, (u8 *) (roam_info->pbFrames + roam_info->nBeaconLength + roam_info->nAssocReqLength); - if (assoc_rsp) { + if (assoc_rsp && + roam_info->nAssocRspLength > + ASSOC_RSP_IES_OFFSET) { /* * assoc_rsp needs to point to the IEs */ @@ -3240,7 +3242,9 @@ hdd_association_completion_handler(struct hdd_adapter *adapter, assoc_req = (u8 *) (roam_info->pbFrames + roam_info->nBeaconLength); if (assoc_req) { - if (!ft_carrier_on) { + if (!ft_carrier_on && + roam_info->nAssocReqLength > + ASSOC_REQ_IES_OFFSET) { /* * assoc_req needs to point to * the IEs @@ -3596,7 +3600,9 @@ hdd_association_completion_handler(struct hdd_adapter *adapter, assoc_req = (u8 *)(roam_info->pbFrames + roam_info->nBeaconLength); - if (assoc_req) { + if (assoc_req && + roam_info->nAssocReqLength > + ASSOC_REQ_IES_OFFSET) { /* * assoc_req needs to point to * the IEs @@ -3615,7 +3621,9 @@ hdd_association_completion_handler(struct hdd_adapter *adapter, (u8 *)(roam_info->pbFrames + roam_info->nBeaconLength + roam_info->nAssocReqLength); - if (assoc_rsp) { + if (assoc_rsp && + roam_info->nAssocRspLength > + ASSOC_RSP_IES_OFFSET) { /* * assoc_rsp needs to point to the IEs */