A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 07:03:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Do not drop the beacon in case of RSN len is less than 2

Browse source 
For security cert TC, RSNIE length can be 1 but if the beacon is
dropped, old entry will remain in scan cache and cause cert TC
failure as connection with old entry with valid RSN IE will pass.

So instead of dropping the frame, do not store the RSN pointer so
that old entry is overwritten.

Change-Id: I2fe4d2dd2352be6850f7a18a2ec829733ded7ee8
CRs-Fixed: 2944120
This commit is contained in:
Abhishek Singh 2021-05-11 17:55:31 +05:30 • committed by Madan Koyyalamudi
commit c71f4e6365
1 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

13
umac/scan/dispatcher/src/wlan_scan_utils_api.c
View file

@ -1035,9 +1035,16 @@ util_scan_populate_bcn_ie_list(struct wlan_objmgr_pdev *pdev,
(uint8_t *)&(((struct htcap_ie *)ie)->ie);
break;
case WLAN_ELEMID_RSN:
if (ie->ie_len < WLAN_RSN_IE_MIN_LEN)
goto err;
scan_params->ie_list.rsn = (uint8_t *)ie;
/*
* For security cert TC, RSNIE length can be 1 but if
* beacon is dropped, old entry will remain in scan
* cache and cause cert TC failure as connection with
* old entry with valid RSN IE will pass.
* So instead of dropping the frame, do not store the
* RSN pointer so that old entry is overwritten.
*/
if (ie->ie_len >= WLAN_RSN_IE_MIN_LEN)
scan_params->ie_list.rsn = (uint8_t *)ie;
break;
case WLAN_ELEMID_XRATES:
scan_params->ie_list.xrates = (uint8_t *)ie;