From 9c636782889cbe48d8c136d334b6b96f28f1cafa Mon Sep 17 00:00:00 2001 From: Huashan Qu Date: Tue, 19 Sep 2023 12:52:31 +0530 Subject: [PATCH] qcacld-3.0: Add extended capabilities IE length check When send assoc req frame, if the length for extended capabilities IE is zero, but present field is non-zero, it will cause assoc req frame malformed issue. Fix is to set present field value to zero when the length for extended capabilities IE is zero. Change-Id: Ie8826e6cfb1fc3a44ee52115ad4482e040f2c38a CRs-Fixed: 3085943 --- core/mac/src/sys/legacy/src/utils/src/parser_api.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/core/mac/src/sys/legacy/src/utils/src/parser_api.c b/core/mac/src/sys/legacy/src/utils/src/parser_api.c index f9100c3d0228..06eba68603ba 100644 --- a/core/mac/src/sys/legacy/src/utils/src/parser_api.c +++ b/core/mac/src/sys/legacy/src/utils/src/parser_api.c @@ -6524,6 +6524,7 @@ QDF_STATUS populate_dot11f_twt_extended_caps(struct mac_context *mac_ctx, dot11f->num_bytes = DOT11F_IE_EXTCAP_MAX_LEN; p_ext_cap = (struct s_ext_cap *)dot11f->bytes; + dot11f->present = 1; if (pe_session->opmode == QDF_STA_MODE) p_ext_cap->twt_requestor_support = @@ -6536,6 +6537,10 @@ QDF_STATUS populate_dot11f_twt_extended_caps(struct mac_context *mac_ctx, mac_ctx->mlme_cfg->twt_cfg.res_flag; dot11f->num_bytes = lim_compute_ext_cap_ie_length(dot11f); + if (!dot11f->num_bytes) { + dot11f->present = 0; + pe_debug("ext ie length become 0, disable the ext caps"); + } return QDF_STATUS_SUCCESS; } @@ -6551,6 +6556,7 @@ QDF_STATUS populate_dot11f_btm_extended_caps(struct mac_context *mac_ctx, pe_debug("enter"); dot11f->num_bytes = DOT11F_IE_EXTCAP_MAX_LEN; p_ext_cap = (struct s_ext_cap *)dot11f->bytes; + dot11f->present = 1; status = cm_akm_roam_allowed(mac_ctx, pe_session->vdev_id); if (QDF_IS_STATUS_ERROR(status)) { @@ -6559,6 +6565,10 @@ QDF_STATUS populate_dot11f_btm_extended_caps(struct mac_context *mac_ctx, } dot11f->num_bytes = lim_compute_ext_cap_ie_length(dot11f); + if (!dot11f->num_bytes) { + dot11f->present = 0; + pe_debug("ext ie length become 0, disable the ext caps"); + } return QDF_STATUS_SUCCESS; }