A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 16:16:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Don't consider beacon length for non-beaconing entities

Browse source 
As part of start_bss response, beacon structures are extracted
from pe_session and stored in bss_description. But non-beaconing
entities like NDI doesn't have a beacon and corresponding
structures in pe_session are not valid. Beacon structures
schBeaconOffsetBegin and schBeaconOffsetEnd contain 0 in such
cases. Calculation of beacon IE length from these would result an
invalid length and leads to invalid IE extraction from
bss_description later(from csr_roam_process_start_bss_success).
Check if pe_session has valid beacon entry to avoid this.

Change-Id: Ic78dfcdbfb83cb29437d46337d13d62df533d780
CRs-Fixed: 2876897
This commit is contained in:
Srinivas Dasari 2021-02-18 15:54:43 +05:30 • committed by snandini
commit 9e06b231b9
2 changed files with 18 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

11
core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
View file

@ -511,7 +511,7 @@ void lim_send_sme_start_bss_rsp(struct mac_context *mac,
uint16_t size = 0;
struct scheduler_msg mmhMsg = {0};
struct start_bss_rsp *pSirSmeRsp;
uint16_t ieLen;
uint16_t beacon_length, ieLen;
uint16_t ieOffset, curLen;
pe_debug("Sending message: %s with reasonCode: %s",
@ -526,8 +526,13 @@ void lim_send_sme_start_bss_rsp(struct mac_context *mac,
} else {
/* subtract size of beaconLength + Mac Hdr + Fixed Fields before SSID */
ieOffset = sizeof(tAniBeaconStruct) + SIR_MAC_B_PR_SSID_OFFSET;
ieLen = pe_session->schBeaconOffsetBegin
+ pe_session->schBeaconOffsetEnd - ieOffset;
beacon_length = pe_session->schBeaconOffsetBegin +
pe_session->schBeaconOffsetEnd;
ieLen = beacon_length - ieOffset;
/* Invalidate for non-beaconing entities */
if (beacon_length <= ieOffset)
ieLen = ieOffset = 0;
/* calculate the memory size to allocate */
size += ieLen;

13
core/sme/src/csr/csr_util.c
View file

@ -1418,9 +1418,16 @@ QDF_STATUS csr_parse_bss_description_ies(struct mac_context *mac_ctx,
tDot11fBeaconIEs *pIEStruct)
{
QDF_STATUS status = QDF_STATUS_E_FAILURE;
int ieLen =
(int)(bss_desc->length + sizeof(bss_desc->length) -
GET_FIELD_OFFSET(struct bss_description, ieFields));
uint16_t ieFields_offset;
int ieLen;
ieFields_offset = GET_FIELD_OFFSET(struct bss_description, ieFields);
if (!bss_desc->length ||
(bss_desc->length - sizeof(bss_desc->length) <= ieFields_offset))
return status;
ieLen = (int)(bss_desc->length + sizeof(bss_desc->length) -
ieFields_offset);
if (ieLen > 0 && pIEStruct) {
if (!DOT11F_FAILED(dot11f_unpack_beacon_i_es