From 7cc925c40372d8fea10759c88c0ff5d0935a6325 Mon Sep 17 00:00:00 2001 From: Naveen Rawat Date: Tue, 12 Dec 2017 17:49:48 -0800 Subject: [PATCH] qcacld-3.0: Reject scan cmd if ie length greater than max allowed Firmware cannot handle scan IE more than a certain size owing to memory restrictions. Check the scan IE length before passing params to firmware. Change-Id: I73321a9d4932f4cbb876de904dacecf15c9083ff CRs-Fixed: 2159363 --- core/wma/src/wma_scan_roam.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c index 35a25447699f..4d79634dc46f 100644 --- a/core/wma/src/wma_scan_roam.c +++ b/core/wma/src/wma_scan_roam.c @@ -202,6 +202,12 @@ QDF_STATUS wma_get_buf_start_scan_cmd(tp_wma_handle wma_handle, return QDF_STATUS_E_FAILURE; } + if (scan_req->uIEFieldLen > WLAN_SCAN_PARAMS_MAX_IE_LEN) { + WMA_LOGD(FL("scan_ie_len (%d) greater than max (%d)"), + scan_req->uIEFieldLen, WLAN_SCAN_PARAMS_MAX_IE_LEN); + return QDF_STATUS_E_INVAL; + } + cmd->vdev_id = scan_req->sessionId; /* * host cycles through the lower 12 bits for scan id generation