From 9e06b231b9a5bd9a2dfb77fe4157d676317cacab Mon Sep 17 00:00:00 2001 From: Srinivas Dasari Date: Thu, 18 Feb 2021 15:54:43 +0530 Subject: [PATCH] qcacld-3.0: Don't consider beacon length for non-beaconing entities As part of start_bss response, beacon structures are extracted from pe_session and stored in bss_description. But non-beaconing entities like NDI doesn't have a beacon and corresponding structures in pe_session are not valid. Beacon structures schBeaconOffsetBegin and schBeaconOffsetEnd contain 0 in such cases. Calculation of beacon IE length from these would result an invalid length and leads to invalid IE extraction from bss_description later(from csr_roam_process_start_bss_success). Check if pe_session has valid beacon entry to avoid this. Change-Id: Ic78dfcdbfb83cb29437d46337d13d62df533d780 CRs-Fixed: 2876897 --- core/mac/src/pe/lim/lim_send_sme_rsp_messages.c | 11 ++++++++--- core/sme/src/csr/csr_util.c | 13 ++++++++++--- 2 files changed, 18 insertions(+), 6 deletions(-) diff --git a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c index 6d7ca4679076..8b6a073ea59e 100644 --- a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c +++ b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c @@ -511,7 +511,7 @@ void lim_send_sme_start_bss_rsp(struct mac_context *mac, uint16_t size = 0; struct scheduler_msg mmhMsg = {0}; struct start_bss_rsp *pSirSmeRsp; - uint16_t ieLen; + uint16_t beacon_length, ieLen; uint16_t ieOffset, curLen; pe_debug("Sending message: %s with reasonCode: %s", @@ -526,8 +526,13 @@ void lim_send_sme_start_bss_rsp(struct mac_context *mac, } else { /* subtract size of beaconLength + Mac Hdr + Fixed Fields before SSID */ ieOffset = sizeof(tAniBeaconStruct) + SIR_MAC_B_PR_SSID_OFFSET; - ieLen = pe_session->schBeaconOffsetBegin - + pe_session->schBeaconOffsetEnd - ieOffset; + beacon_length = pe_session->schBeaconOffsetBegin + + pe_session->schBeaconOffsetEnd; + ieLen = beacon_length - ieOffset; + + /* Invalidate for non-beaconing entities */ + if (beacon_length <= ieOffset) + ieLen = ieOffset = 0; /* calculate the memory size to allocate */ size += ieLen; diff --git a/core/sme/src/csr/csr_util.c b/core/sme/src/csr/csr_util.c index 46781b2be076..54762ec7de29 100644 --- a/core/sme/src/csr/csr_util.c +++ b/core/sme/src/csr/csr_util.c @@ -1418,9 +1418,16 @@ QDF_STATUS csr_parse_bss_description_ies(struct mac_context *mac_ctx, tDot11fBeaconIEs *pIEStruct) { QDF_STATUS status = QDF_STATUS_E_FAILURE; - int ieLen = - (int)(bss_desc->length + sizeof(bss_desc->length) - - GET_FIELD_OFFSET(struct bss_description, ieFields)); + uint16_t ieFields_offset; + int ieLen; + + ieFields_offset = GET_FIELD_OFFSET(struct bss_description, ieFields); + if (!bss_desc->length || + (bss_desc->length - sizeof(bss_desc->length) <= ieFields_offset)) + return status; + + ieLen = (int)(bss_desc->length + sizeof(bss_desc->length) - + ieFields_offset); if (ieLen > 0 && pIEStruct) { if (!DOT11F_FAILED(dot11f_unpack_beacon_i_es