From b37228af58e173c8ca9bb0d57fe116226bf60bb5 Mon Sep 17 00:00:00 2001 From: Min Liu Date: Fri, 13 Nov 2020 19:14:42 +0800 Subject: [PATCH] qcacld-3.0: Update validation for SA Query frames Update the validation for SA Query Request/Response to fix the issue that these frames are dropped unexpectedly when OCI IE is not present. Change-Id: I57acd699fd5c7eba23551133e3439fe23c1949a4 CRs-Fixed: 2846717 --- core/mac/src/pe/lim/lim_process_action_frame.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/core/mac/src/pe/lim/lim_process_action_frame.c b/core/mac/src/pe/lim/lim_process_action_frame.c index 0031307f48ef..3af5b2e04f8f 100644 --- a/core/mac/src/pe/lim/lim_process_action_frame.c +++ b/core/mac/src/pe/lim/lim_process_action_frame.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012-2020 The Linux Foundation. All rights reserved. + * Copyright (c) 2012-2021 The Linux Foundation. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -53,6 +53,11 @@ #include "dot11f.h" #include "wlan_p2p_cfg_api.h" +#define SA_QUERY_REQ_MIN_LEN \ +(DOT11F_FF_CATEGORY_LEN + DOT11F_FF_ACTION_LEN + DOT11F_FF_TRANSACTIONID_LEN) +#define SA_QUERY_RESP_MIN_LEN \ +(DOT11F_FF_CATEGORY_LEN + DOT11F_FF_ACTION_LEN + DOT11F_FF_TRANSACTIONID_LEN) + static last_processed_msg rrm_link_action_frm; /**----------------------------------------------------------------- @@ -1248,8 +1253,8 @@ static void __lim_process_sa_query_request_action_frame(struct mac_context *mac, pBody = WMA_GET_RX_MPDU_DATA(pRxPacketInfo); frame_len = WMA_GET_RX_PAYLOAD_LEN(pRxPacketInfo); - if (frame_len < sizeof(struct sDot11fSaQueryReq)) { - pe_err("Invalid frame length"); + if (frame_len < SA_QUERY_REQ_MIN_LEN) { + pe_err("Invalid frame length %d", frame_len); return; } /* If this is an unprotected SA Query Request, then ignore it. */ @@ -1315,8 +1320,8 @@ static void __lim_process_sa_query_response_action_frame(struct mac_context *mac pBody = WMA_GET_RX_MPDU_DATA(pRxPacketInfo); pe_debug("SA Query Response received"); - if (frame_len < sizeof(struct sDot11fSaQueryRsp)) { - pe_err("Invalid frame length"); + if (frame_len < SA_QUERY_RESP_MIN_LEN) { + pe_err("Invalid frame length %d", frame_len); return; } /* When a station, supplicant handles SA Query Response.