From b2d48354301d62bafd6740aa15efaf2f9f036cc5 Mon Sep 17 00:00:00 2001 From: Aravind Kishore Sukla Date: Wed, 8 Feb 2023 14:45:03 +0530 Subject: [PATCH] qcacld-3.0: Ignore CSA request for invalid channel In present scenario, STA disconnects with AP if it receives invalid channel in CSA IE. In this case STA shouldn't disconnect with AP as this request may come from a spoof AP. Ignore this CSA request as it might be from spoof AP and if it is from genuine AP heart beat failure happens and results in disconnection. After disconnection DUT may reconnect to same or other APs. Mot-CRs-fixed: (CR) CVE-Fixed: CVE-2023-28584 Bug: 285903061 Change-Id: Ic46ac6d6fa633bd6dbcb188ce616265f297bdf44 CRs-Fixed: 3390251 Signed-off-by: Ashutosh Verma Change-Id: Ic46ac6d6fa633bd6dbcb188ce616265f297bdf44 Reviewed-on: https://gerrit.mot.com/2704837 SME-Granted: SME Approvals Granted SLTApproved: Slta Waiver Tested-by: Jira Key Reviewed-by: Xiangpo Zhao Submit-Approved: Jira Key --- core/mac/src/pe/lim/lim_utils.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/core/mac/src/pe/lim/lim_utils.c b/core/mac/src/pe/lim/lim_utils.c index 6124376906d6..4bacc753e895 100644 --- a/core/mac/src/pe/lim/lim_utils.c +++ b/core/mac/src/pe/lim/lim_utils.c @@ -1873,20 +1873,16 @@ static void __lim_process_channel_switch_timeout(struct pe_session *pe_session) } /* - * If the channel-list that AP is asking us to switch is invalid - * then we cannot switch the channel. Just disassociate from AP. - * We will find a better AP !!! + * The channel switch request received from AP is carrying + * invalid channel. It's ok to ignore this channel switch + * request as it might be from spoof AP. If it's from genuine + * AP, it may lead to heart beat failure and result in + * disconnection. DUT can go ahead and reconnect to it/any + * other AP once it disconnects. */ - if ((pe_session->limMlmState == - eLIM_MLM_LINK_ESTABLISHED_STATE) && - (pe_session->limSmeState != eLIM_SME_WT_DISASSOC_STATE) && - (pe_session->limSmeState != eLIM_SME_WT_DEAUTH_STATE)) { - pe_err("Invalid channel! Disconnect"); - lim_tear_down_link_with_ap(mac, pe_session->peSessionId, - REASON_UNSUPPORTED_CHANNEL_CSA, - eLIM_LINK_MONITORING_DISASSOC); - return; - } + pe_err("Invalid channel freq %u Ignore CSA request", + channel_freq); + return; } switch (pe_session->gLimChannelSwitch.state) { case eLIM_CHANNEL_SWITCH_PRIMARY_ONLY: