qcacld-3.0: Stop SAP on invalid RSN IE

Hostapd sends RSNIE with around 18AKMs. However, the driver
data structures allow storage upto 6 AKMs only. Therefore,
the dot11f unpack modules returns BAD IE. The akm suite
however carries the parsed count of 18.

The HDD caller checks only DOT11F_FAILED, which doesn't cover
many of the DOT11F_xx failure status codes. Therefore, instead
of failing BSS, the IE is processed further and access of 18
contiguous AKMs takes place leading to OOB read crash.

To fix this, check for all the failure status code and stop
the BSS upon RSN/WPA/WAPI IE parse failure.

Change-Id: I16399c8a5bd61b09d29cd88e35c0ec441c6b9af4
CRs-Fixed: 3445762

core/hdd/src/wlan_hdd_hostapd.c

@@ -3092,7 +3092,7 @@ static int hdd_softap_unpack_ie(mac_handle_t mac_handle,
 		memset(&dot11_rsn_ie, 0, sizeof(tDot11fIERSN));
 		ret = sme_unpack_rsn_ie(mac_handle, rsn_ie, rsn_ie_len,
 					&dot11_rsn_ie, false);
-		if (DOT11F_FAILED(ret)) {
+		if (!DOT11F_SUCCEEDED(ret)) {
 			hdd_err("unpack failed, 0x%x", ret);
 			return -EINVAL;
 		}
@@ -3133,7 +3133,7 @@ static int hdd_softap_unpack_ie(mac_handle_t mac_handle,
 		ret = dot11f_unpack_ie_wpa(MAC_CONTEXT(mac_handle),
 					   rsn_ie, rsn_ie_len,
 					   &dot11_wpa_ie, false);
-		if (DOT11F_FAILED(ret)) {
+		if (!DOT11F_SUCCEEDED(ret)) {
 			hdd_err("unpack failed, 0x%x", ret);
 			return -EINVAL;
 		}
@@ -3173,7 +3173,7 @@ static int hdd_softap_unpack_ie(mac_handle_t mac_handle,
 		ret = dot11f_unpack_ie_wapi(MAC_CONTEXT(mac_handle),
 					    rsn_ie, rsn_ie_len,
 					    &dot11_wapi_ie, false);
-		if (DOT11F_FAILED(ret)) {
+		if (!DOT11F_SUCCEEDED(ret)) {
 			hdd_err("unpack failed, 0x%x", ret);
 			return -EINVAL;
 		}
@@ -6331,8 +6331,10 @@ int wlan_hdd_cfg80211_start_bss(struct hdd_adapter *adapter,
 					     &mfp_required,
 					     config->RSNWPAReqIE[1] + 2,
 					     config->RSNWPAReqIE);
-
-		if (QDF_STATUS_SUCCESS == status) {
+		if (status != QDF_STATUS_SUCCESS) {
+			ret = -EINVAL;
+			goto error;
+		} else {
 			/* Now copy over all the security attributes you have
 			 * parsed out. Use the cipher type in the RSN IE
 			 */
@@ -6385,7 +6387,10 @@ int wlan_hdd_cfg80211_start_bss(struct hdd_adapter *adapter,
 					 config->RSNWPAReqIE[1] + 2,
 					 config->RSNWPAReqIE);
 
-			if (QDF_STATUS_SUCCESS == status) {
+			if (status != QDF_STATUS_SUCCESS) {
+				ret = -EINVAL;
+				goto error;
+			} else {
 				(WLAN_HDD_GET_AP_CTX_PTR(adapter))->
 				encryption_type = rsn_encrypt_type;
 				hdd_debug("CSR Encryption: %d mcEncryption: %d num_akm_suites:%d",