浏览代码

qcacld-3.0: Don't fill MLO IEs on association reject

Driver will reject the association request from a peer
which is already in connected state, in this case
to fill MLO IEs in the assoc response frame, access to
already freed assoc request pointer of the peer results
in NULL pointer dereference.

If association is rejected with reason code
STATUS_ASSOC_REJECTED_TEMPORARILY, don't fill
MLO IEs in the assoc response frame.

Change-Id: I10a71d9fe7cc1bb025a6d004b29ee5236f546ec7
CRs-Fixed: 3337520
Vinod Kumar Pirla 2 年之前
父节点
当前提交
1bdb20d229
共有 1 个文件被更改,包括 2 次插入1 次删除
  1. 2 1
      core/mac/src/pe/lim/lim_send_management_frames.c

+ 2 - 1
core/mac/src/pe/lim/lim_send_management_frames.c

@@ -1904,7 +1904,8 @@ lim_send_assoc_rsp_mgmt_frame(struct mac_context *mac_ctx,
 	if (sta && lim_is_sta_eht_capable(sta) &&
 	    lim_is_mlo_conn(pe_session, sta) &&
 	    lim_is_session_eht_capable(pe_session) &&
-	    wlan_vdev_mlme_is_mlo_ap(pe_session->vdev)) {
+	    wlan_vdev_mlme_is_mlo_ap(pe_session->vdev) &&
+	    (status_code != STATUS_ASSOC_REJECTED_TEMPORARILY)) {
 		pe_debug("Populate mlo IEs");
 		mlo_ie_len = lim_send_assoc_rsp_mgmt_frame_mlo(mac_ctx,
 							       pe_session,