diff --git a/core/mac/src/pe/lim/lim_process_auth_frame.c b/core/mac/src/pe/lim/lim_process_auth_frame.c index 35bbdeebefb2..1e9ed633d08a 100644 --- a/core/mac/src/pe/lim/lim_process_auth_frame.c +++ b/core/mac/src/pe/lim/lim_process_auth_frame.c @@ -1711,15 +1711,14 @@ bool lim_process_sae_preauth_frame(struct mac_context *mac, uint8_t *rx_pkt) * ***---------------------------------------------------------------------- */ -QDF_STATUS lim_process_auth_frame_no_session(struct mac_context *mac, uint8_t *pBd, - void *body) +QDF_STATUS lim_process_auth_frame_no_session(struct mac_context *mac, + uint8_t *pBd, void *body) { tpSirMacMgmtHdr pHdr; struct pe_session *pe_session = NULL; uint8_t *pBody; uint16_t frameLen; - tSirMacAuthFrameBody rxAuthFrame; - tSirMacAuthFrameBody *pRxAuthFrameBody = NULL; + tSirMacAuthFrameBody *rx_auth_frame; QDF_STATUS ret_status = QDF_STATUS_E_FAILURE; int i; bool sae_auth_frame; @@ -1821,28 +1820,36 @@ QDF_STATUS lim_process_auth_frame_no_session(struct mac_context *mac, uint8_t *p /* of our choice. */ lim_deactivate_and_change_timer(mac, eLIM_FT_PREAUTH_RSP_TIMER); + rx_auth_frame = qdf_mem_malloc(sizeof(*rx_auth_frame)); + if (!rx_auth_frame) { + lim_handle_ft_pre_auth_rsp(mac, QDF_STATUS_E_FAILURE, NULL, 0, + pe_session); + return QDF_STATUS_E_NOMEM; + } + /* Save off the auth resp. */ - if ((sir_convert_auth_frame2_struct(mac, pBody, frameLen, &rxAuthFrame) != - QDF_STATUS_SUCCESS)) { + if ((sir_convert_auth_frame2_struct(mac, pBody, frameLen, + rx_auth_frame) != + QDF_STATUS_SUCCESS)) { pe_err("failed to convert Auth frame to struct"); lim_handle_ft_pre_auth_rsp(mac, QDF_STATUS_E_FAILURE, NULL, 0, pe_session); + qdf_mem_free(rx_auth_frame); return QDF_STATUS_E_FAILURE; } - pRxAuthFrameBody = &rxAuthFrame; pe_debug("Received Auth frame with type: %d seqnum: %d status: %d %d", - (uint32_t) pRxAuthFrameBody->authAlgoNumber, - (uint32_t) pRxAuthFrameBody->authTransactionSeqNumber, - (uint32_t) pRxAuthFrameBody->authStatusCode, - (uint32_t) mac->lim.gLimNumPreAuthContexts); - switch (pRxAuthFrameBody->authTransactionSeqNumber) { + (uint32_t)rx_auth_frame->authAlgoNumber, + (uint32_t)rx_auth_frame->authTransactionSeqNumber, + (uint32_t)rx_auth_frame->authStatusCode, + (uint32_t)mac->lim.gLimNumPreAuthContexts); + switch (rx_auth_frame->authTransactionSeqNumber) { case SIR_MAC_AUTH_FRAME_2: - if (pRxAuthFrameBody->authStatusCode != STATUS_SUCCESS) { + if (rx_auth_frame->authStatusCode != STATUS_SUCCESS) { pe_err("Auth status code received is %d", - (uint32_t) pRxAuthFrameBody->authStatusCode); + (uint32_t)rx_auth_frame->authStatusCode); if (STATUS_AP_UNABLE_TO_HANDLE_NEW_STA == - pRxAuthFrameBody->authStatusCode) + rx_auth_frame->authStatusCode) ret_status = QDF_STATUS_E_NOSPC; } else { ret_status = QDF_STATUS_SUCCESS; @@ -1851,12 +1858,14 @@ QDF_STATUS lim_process_auth_frame_no_session(struct mac_context *mac, uint8_t *p default: pe_warn("Seq. no incorrect expected 2 received %d", - (uint32_t) pRxAuthFrameBody->authTransactionSeqNumber); + (uint32_t)rx_auth_frame->authTransactionSeqNumber); break; } /* Send the Auth response to SME */ - lim_handle_ft_pre_auth_rsp(mac, ret_status, pBody, frameLen, pe_session); + lim_handle_ft_pre_auth_rsp(mac, ret_status, pBody, + frameLen, pe_session); + qdf_mem_free(rx_auth_frame); return ret_status; }