A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Add extended capabilities IE length check

Browse source 
When send assoc req frame, if the length for extended capabilities
IE is zero, but present field is non-zero, it will cause assoc req
frame malformed issue.

Fix is to set present field value to zero when the length for
extended capabilities IE is zero.

Change-Id: Ie8826e6cfb1fc3a44ee52115ad4482e040f2c38a
CRs-Fixed: 3085943
This commit is contained in:
Huashan Qu 2023-09-19 12:52:31 +05:30 • committed by Rahul Choudhary
commit 9c63678288
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
core/mac/src/sys/legacy/src/utils/src/parser_api.c
View file

@ -6524,6 +6524,7 @@ QDF_STATUS populate_dot11f_twt_extended_caps(struct mac_context *mac_ctx,
dot11f->num_bytes = DOT11F_IE_EXTCAP_MAX_LEN;
p_ext_cap = (struct s_ext_cap *)dot11f->bytes;
dot11f->present = 1;
if (pe_session->opmode == QDF_STA_MODE)
p_ext_cap->twt_requestor_support =
@ -6536,6 +6537,10 @@ QDF_STATUS populate_dot11f_twt_extended_caps(struct mac_context *mac_ctx,
mac_ctx->mlme_cfg->twt_cfg.res_flag;
dot11f->num_bytes = lim_compute_ext_cap_ie_length(dot11f);
if (!dot11f->num_bytes) {
dot11f->present = 0;
pe_debug("ext ie length become 0, disable the ext caps");
}
return QDF_STATUS_SUCCESS;
}
@ -6551,6 +6556,7 @@ QDF_STATUS populate_dot11f_btm_extended_caps(struct mac_context *mac_ctx,
pe_debug("enter");
dot11f->num_bytes = DOT11F_IE_EXTCAP_MAX_LEN;
p_ext_cap = (struct s_ext_cap *)dot11f->bytes;
dot11f->present = 1;
status = cm_akm_roam_allowed(mac_ctx, pe_session->vdev_id);
if (QDF_IS_STATUS_ERROR(status)) {
@ -6559,6 +6565,10 @@ QDF_STATUS populate_dot11f_btm_extended_caps(struct mac_context *mac_ctx,
}
dot11f->num_bytes = lim_compute_ext_cap_ie_length(dot11f);
if (!dot11f->num_bytes) {
dot11f->present = 0;
pe_debug("ext ie length become 0, disable the ext caps");
}
return QDF_STATUS_SUCCESS;
}