From e30a7f5b7d343dfd03d2294129e4dfb523efa338 Mon Sep 17 00:00:00 2001 From: Jeff Johnson Date: Mon, 7 May 2018 17:46:00 -0700 Subject: [PATCH] qcacmn: Fix NDP Response Code policy The qca_wlan_vendor_ndp_policy for the attribute QCA_WLAN_VENDOR_ATTR_NDP_RESPONSE_CODE currently specifies type NLA_U16. However this attribute is defined to be an unsigned 32 bit value, and nla_get_u32() is used to read the value, so change the policy to use type NLA_U32 so that nla_parse() can properly verify that the TLV payload has (at least) 4 bytes of data. Change-Id: I915a94e7449c2bc1abde64e2a7f5df6a58488ed6 CRs-Fixed: 2237659 --- os_if/linux/nan/src/os_if_nan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/os_if/linux/nan/src/os_if_nan.c b/os_if/linux/nan/src/os_if_nan.c index a5c6bb454a65..f395725711b5 100644 --- a/os_if/linux/nan/src/os_if_nan.c +++ b/os_if/linux/nan/src/os_if_nan.c @@ -79,8 +79,8 @@ vendor_attr_policy[QCA_WLAN_VENDOR_ATTR_NDP_PARAMS_MAX + 1] = { .len = sizeof(uint32_t) }, [QCA_WLAN_VENDOR_ATTR_NDP_RESPONSE_CODE] = { - .type = NLA_U16, - .len = sizeof(uint16_t) + .type = NLA_U32, + .len = sizeof(uint32_t) }, [QCA_WLAN_VENDOR_ATTR_NDP_NDI_MAC_ADDR] = { .type = NLA_BINARY,