Browse Source

qcacld-3.0: Don't fill MLO IEs on association reject

Driver will reject the association request from a peer
which is already in connected state, in this case
to fill MLO IEs in the assoc response frame, access to
already freed assoc request pointer of the peer results
in NULL pointer dereference.

If association is rejected with reason code
STATUS_ASSOC_REJECTED_TEMPORARILY, don't fill
MLO IEs in the assoc response frame.

Change-Id: I10a71d9fe7cc1bb025a6d004b29ee5236f546ec7
CRs-Fixed: 3337520
Vinod Kumar Pirla 2 years ago
parent
commit
1bdb20d229
1 changed files with 2 additions and 1 deletions
  1. 2 1
      core/mac/src/pe/lim/lim_send_management_frames.c

+ 2 - 1
core/mac/src/pe/lim/lim_send_management_frames.c

@@ -1904,7 +1904,8 @@ lim_send_assoc_rsp_mgmt_frame(struct mac_context *mac_ctx,
 	if (sta && lim_is_sta_eht_capable(sta) &&
 	    lim_is_mlo_conn(pe_session, sta) &&
 	    lim_is_session_eht_capable(pe_session) &&
-	    wlan_vdev_mlme_is_mlo_ap(pe_session->vdev)) {
+	    wlan_vdev_mlme_is_mlo_ap(pe_session->vdev) &&
+	    (status_code != STATUS_ASSOC_REJECTED_TEMPORARILY)) {
 		pe_debug("Populate mlo IEs");
 		mlo_ie_len = lim_send_assoc_rsp_mgmt_frame_mlo(mac_ctx,
 							       pe_session,