Browse Source

qcacld-3.0: Fix the max length of keyname nai

Fix the maximum permissible length for Keyname NAI and also
perform a check for the same.

Change-Id: Ib6eaa11a470202fcde7495f788ab6d3c0272cefe
CRs-Fixed: 2126720
Varun Reddy Yeturu 7 years ago
parent
commit
82e39cd004
2 changed files with 16 additions and 3 deletions
  1. 1 1
      core/cds/inc/cds_config.h
  2. 15 2
      core/hdd/src/wlan_hdd_cfg80211.c

+ 1 - 1
core/cds/inc/cds_config.h

@@ -176,7 +176,7 @@ struct cds_config_info {
 #ifdef WLAN_FEATURE_FILS_SK
 #define MAX_PMK_LEN 48
 #define MAX_PMKID_LEN 16
-#define FILS_MAX_KEYNAME_NAI_LENGTH 255
+#define FILS_MAX_KEYNAME_NAI_LENGTH 253
 #define FILS_MAX_REALM_LEN 255
 #define FILS_MAX_RRK_LENGTH 64
 #define FILS_MAX_RIK_LENGTH FILS_MAX_RRK_LENGTH

+ 15 - 2
core/hdd/src/wlan_hdd_cfg80211.c

@@ -16040,7 +16040,7 @@ static int wlan_hdd_cfg80211_set_fils_config(struct hdd_adapter *adapter,
 	auth_type = wlan_hdd_get_fils_auth_type(req->auth_type);
 	if (auth_type == eSIR_DONOT_USE_AUTH_TYPE) {
 		hdd_err("invalid auth type for fils %d", req->auth_type);
-		return -EINVAL;
+		goto fils_conn_fail;
 	}
 
 	hdd_debug("seq=%d auth=%d lengths: user=%zu rrk=%zu realm=%zu",
@@ -16051,7 +16051,7 @@ static int wlan_hdd_cfg80211_set_fils_config(struct hdd_adapter *adapter,
 		req->fils_erp_realm_len > WMI_FILS_MAX_REALM_LENGTH ||
 		req->fils_erp_username_len > WMI_FILS_MAX_USERNAME_LENGTH) {
 		hdd_err("FILS info length limit exceeded");
-		return -EINVAL;
+		goto fils_conn_fail;
 	}
 
 	roam_profile->fils_con_info->is_fils_connection = true;
@@ -16077,6 +16077,12 @@ static int wlan_hdd_cfg80211_set_fils_config(struct hdd_adapter *adapter,
 				req->fils_erp_realm_len;
 	hdd_debug("key_nai_length = %d",
 		  roam_profile->fils_con_info->key_nai_length);
+	if (roam_profile->fils_con_info->key_nai_length >
+		FILS_MAX_KEYNAME_NAI_LENGTH) {
+		hdd_err("Do not allow FILS conn due to excess NAI Length %d",
+			roam_profile->fils_con_info->key_nai_length);
+		goto fils_conn_fail;
+	}
 	if (req->fils_erp_username_len) {
 		buf = roam_profile->fils_con_info->keyname_nai;
 		qdf_mem_copy(buf,
@@ -16090,6 +16096,13 @@ static int wlan_hdd_cfg80211_set_fils_config(struct hdd_adapter *adapter,
 	}
 
 	return 0;
+
+fils_conn_fail:
+	if (roam_profile->fils_con_info) {
+		qdf_mem_free(roam_profile->fils_con_info);
+		roam_profile->fils_con_info = NULL;
+	}
+	return -EINVAL;
 }
 
 static bool wlan_hdd_is_akm_suite_fils(uint32_t key_mgmt)