A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Update validation for SA Query frames

Browse source 
Update the validation for SA Query Request/Response to fix the
issue that these frames are dropped unexpectedly when OCI IE
is not present.

Change-Id: I57acd699fd5c7eba23551133e3439fe23c1949a4
CRs-Fixed: 2846717
This commit is contained in:
Min Liu 2020-11-13 19:14:42 +08:00 • committed by snandini
commit b37228af58
1 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

15
core/mac/src/pe/lim/lim_process_action_frame.c
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2012-2020 The Linux Foundation. All rights reserved.
* Copyright (c) 2012-2021 The Linux Foundation. All rights reserved.
*
* Permission to use, copy, modify, and/or distribute this software for
* any purpose with or without fee is hereby granted, provided that the
@ -53,6 +53,11 @@
#include "dot11f.h"
#include "wlan_p2p_cfg_api.h"
#define SA_QUERY_REQ_MIN_LEN \
(DOT11F_FF_CATEGORY_LEN + DOT11F_FF_ACTION_LEN + DOT11F_FF_TRANSACTIONID_LEN)
#define SA_QUERY_RESP_MIN_LEN \
(DOT11F_FF_CATEGORY_LEN + DOT11F_FF_ACTION_LEN + DOT11F_FF_TRANSACTIONID_LEN)
static last_processed_msg rrm_link_action_frm;
/**-----------------------------------------------------------------
@ -1248,8 +1253,8 @@ static void __lim_process_sa_query_request_action_frame(struct mac_context *mac,
pBody = WMA_GET_RX_MPDU_DATA(pRxPacketInfo);
frame_len = WMA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
if (frame_len < sizeof(struct sDot11fSaQueryReq)) {
pe_err("Invalid frame length");
if (frame_len < SA_QUERY_REQ_MIN_LEN) {
pe_err("Invalid frame length %d", frame_len);
return;
}
/* If this is an unprotected SA Query Request, then ignore it. */
@ -1315,8 +1320,8 @@ static void __lim_process_sa_query_response_action_frame(struct mac_context *mac
pBody = WMA_GET_RX_MPDU_DATA(pRxPacketInfo);
pe_debug("SA Query Response received");
if (frame_len < sizeof(struct sDot11fSaQueryRsp)) {
pe_err("Invalid frame length");
if (frame_len < SA_QUERY_RESP_MIN_LEN) {
pe_err("Invalid frame length %d", frame_len);
return;
}
/* When a station, supplicant handles SA Query Response.