Browse Source

qcacld-3.0: Zero RIC pointer if RIC len is 0

Currently ric_ies pointer of struct cfg80211_ft_event_params is pointer
of local stack, even RIC len is 0. It introduced MIC mismatch when H2E
enabled between STAUT and AP.

Change to assign valid RIC pointer only when RIC len greater than 0.
This function only valid for LFR2.0 FT roaming.

Change-Id: I7a1c4f424ef9a8a18b2852e3647cb12b4ec07f02
CRs-Fixed: 3113941
Will Huang 3 years ago
parent
commit
2104c557f0
1 changed files with 7 additions and 8 deletions
  1. 7 8
      core/hdd/src/wlan_hdd_cm_connect.c

+ 7 - 8
core/hdd/src/wlan_hdd_cm_connect.c

@@ -1561,9 +1561,9 @@ QDF_STATUS hdd_cm_ft_preauth_complete(struct wlan_objmgr_vdev *vdev,
 	struct wireless_dev *wdev;
 	uint16_t auth_resp_len = 0;
 	uint32_t ric_ies_length = 0;
-	struct cfg80211_ft_event_params ft_event;
-	uint8_t ft_ie[DOT11F_IE_FTINFO_MAX_LEN];
-	uint8_t ric_ies[DOT11F_IE_RICDESCRIPTOR_MAX_LEN];
+	struct cfg80211_ft_event_params ft_event = {0};
+	uint8_t ft_ie[DOT11F_IE_FTINFO_MAX_LEN] = {0};
+	uint8_t ric_ies[DOT11F_IE_RICDESCRIPTOR_MAX_LEN] = {0};
 
 	mac_handle = cds_get_context(QDF_MODULE_ID_SME);
 	if (!mac_handle) {
@@ -1582,9 +1582,6 @@ QDF_STATUS hdd_cm_ft_preauth_complete(struct wlan_objmgr_vdev *vdev,
 		return QDF_STATUS_E_INVAL;
 	}
 
-	qdf_mem_zero(ft_ie, DOT11F_IE_FTINFO_MAX_LEN);
-	qdf_mem_zero(ric_ies, DOT11F_IE_RICDESCRIPTOR_MAX_LEN);
-
 	if (rsp->ric_ies_length &&
 	    rsp->ric_ies_length <= DOT11F_IE_RICDESCRIPTOR_MAX_LEN) {
 		qdf_mem_copy(ric_ies, rsp->ric_ies, rsp->ric_ies_length);
@@ -1593,8 +1590,10 @@ QDF_STATUS hdd_cm_ft_preauth_complete(struct wlan_objmgr_vdev *vdev,
 		hdd_warn("Do not send RIC IEs as length is 0");
 	}
 
-	ft_event.ric_ies = ric_ies;
-	ft_event.ric_ies_len = ric_ies_length;
+	if (ric_ies_length) {
+		ft_event.ric_ies = ric_ies;
+		ft_event.ric_ies_len = ric_ies_length;
+	}
 	hdd_debug("RIC IEs is of length %d", ric_ies_length);
 
 	hdd_cm_get_ft_preauth_response(vdev, rsp, ft_ie,