From 82e39cd00465c19cfdfef500c7ebfbf82e6d7546 Mon Sep 17 00:00:00 2001 From: Varun Reddy Yeturu Date: Mon, 16 Oct 2017 12:04:05 -0700 Subject: [PATCH] qcacld-3.0: Fix the max length of keyname nai Fix the maximum permissible length for Keyname NAI and also perform a check for the same. Change-Id: Ib6eaa11a470202fcde7495f788ab6d3c0272cefe CRs-Fixed: 2126720 --- core/cds/inc/cds_config.h | 2 +- core/hdd/src/wlan_hdd_cfg80211.c | 17 +++++++++++++++-- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/core/cds/inc/cds_config.h b/core/cds/inc/cds_config.h index b59f20757ca1..270656fe5b8c 100644 --- a/core/cds/inc/cds_config.h +++ b/core/cds/inc/cds_config.h @@ -176,7 +176,7 @@ struct cds_config_info { #ifdef WLAN_FEATURE_FILS_SK #define MAX_PMK_LEN 48 #define MAX_PMKID_LEN 16 -#define FILS_MAX_KEYNAME_NAI_LENGTH 255 +#define FILS_MAX_KEYNAME_NAI_LENGTH 253 #define FILS_MAX_REALM_LEN 255 #define FILS_MAX_RRK_LENGTH 64 #define FILS_MAX_RIK_LENGTH FILS_MAX_RRK_LENGTH diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c index a2444090d649..8b1b448776f9 100644 --- a/core/hdd/src/wlan_hdd_cfg80211.c +++ b/core/hdd/src/wlan_hdd_cfg80211.c @@ -16040,7 +16040,7 @@ static int wlan_hdd_cfg80211_set_fils_config(struct hdd_adapter *adapter, auth_type = wlan_hdd_get_fils_auth_type(req->auth_type); if (auth_type == eSIR_DONOT_USE_AUTH_TYPE) { hdd_err("invalid auth type for fils %d", req->auth_type); - return -EINVAL; + goto fils_conn_fail; } hdd_debug("seq=%d auth=%d lengths: user=%zu rrk=%zu realm=%zu", @@ -16051,7 +16051,7 @@ static int wlan_hdd_cfg80211_set_fils_config(struct hdd_adapter *adapter, req->fils_erp_realm_len > WMI_FILS_MAX_REALM_LENGTH || req->fils_erp_username_len > WMI_FILS_MAX_USERNAME_LENGTH) { hdd_err("FILS info length limit exceeded"); - return -EINVAL; + goto fils_conn_fail; } roam_profile->fils_con_info->is_fils_connection = true; @@ -16077,6 +16077,12 @@ static int wlan_hdd_cfg80211_set_fils_config(struct hdd_adapter *adapter, req->fils_erp_realm_len; hdd_debug("key_nai_length = %d", roam_profile->fils_con_info->key_nai_length); + if (roam_profile->fils_con_info->key_nai_length > + FILS_MAX_KEYNAME_NAI_LENGTH) { + hdd_err("Do not allow FILS conn due to excess NAI Length %d", + roam_profile->fils_con_info->key_nai_length); + goto fils_conn_fail; + } if (req->fils_erp_username_len) { buf = roam_profile->fils_con_info->keyname_nai; qdf_mem_copy(buf, @@ -16090,6 +16096,13 @@ static int wlan_hdd_cfg80211_set_fils_config(struct hdd_adapter *adapter, } return 0; + +fils_conn_fail: + if (roam_profile->fils_con_info) { + qdf_mem_free(roam_profile->fils_con_info); + roam_profile->fils_con_info = NULL; + } + return -EINVAL; } static bool wlan_hdd_is_akm_suite_fils(uint32_t key_mgmt)