A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 00:24:41 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix incorrect memory comparison in cds_is_mmie_valid

Browse source 
Fix incorrect memory comparison cds_is_mmie_valid.

In cds_is_mmie_valid(), while processing Rx Robust Management Frame
invalid condition usage results in incorrectly tagging the Rx packet for
replay attack. Similar invalid condition results in incorrectly
tagging the packets for MIC mismatch. This change will update the checks
so that Rx packets will not be dropped incorrectly.

Change-Id: I50974232db034029747e0af8c8b5b70959c4dcb7
CRs-Fixed: 1057261
This commit is contained in:
Krishna Kumaar Natarajan 2016-08-20 17:54:20 -07:00 • committed by Gerrit - the friendly Code Review server
commit a7315f2414
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
core/cds/src/cds_utils.c
View file

@ -483,7 +483,7 @@ cds_is_mmie_valid(uint8_t *igtk, uint8_t *ipn, uint8_t *frm, uint8_t *efrm)
/* Validate IPN */
rx_ipn = mmie->sequence_number;
if (OS_MEMCMP(rx_ipn, ipn, CMAC_IPN_LEN) > 0) {
if (OS_MEMCMP(rx_ipn, ipn, CMAC_IPN_LEN) <= 0) {
/* Replay error */
QDF_TRACE(QDF_MODULE_ID_QDF, QDF_TRACE_LEVEL_ERROR,
"Replay error mmie ipn %02X %02X %02X %02X %02X %02X"
@ -546,7 +546,7 @@ cds_is_mmie_valid(uint8_t *igtk, uint8_t *ipn, uint8_t *frm, uint8_t *efrm)
mic[0], mic[1], mic[2], mic[3],
mic[4], mic[5], mic[6], mic[7]);
if (OS_MEMCMP(mic, mmie->mic, CMAC_TLEN) == 0) {
if (OS_MEMCMP(mic, mmie->mic, CMAC_TLEN) != 0) {
/* MMIE MIC mismatch */
QDF_TRACE(QDF_MODULE_ID_QDF, QDF_TRACE_LEVEL_ERROR,
"BC/MC MGMT frame MMIE MIC check Failed"