Explorar o código

qcacld-3.0: Fix stack corruption issue in sme_RrmProcessNeighborReport

qcacld-2.0 to qcacld-3.0 propagation

When STA process Neighbor report from AP, session_id is declared
as one byte variable and its overwritten with four bytes value
in csrRoamGetSessionIdFromBSSID. This is observed on enabling stack
protection in kernel config(CONFIG_CC_STACKPROTECTOR).

Fix is to declare session_id as four bytes variable.

Git-commit: 96646d1eb48c4f3bf45555b8f636f90cf925b8b8
Change-Id: I6b2fd40a5466fe5dd72d394abb682229a550e0b1
CRs-Fixed: 1025272
Selvaraj, Sridhar %!s(int64=8) %!d(string=hai) anos
pai
achega
bc950df65f

+ 1 - 1
core/sme/inc/csr_internal.h

@@ -1309,7 +1309,7 @@ bool csr_roam_is11r_assoc(tpAniSirGlobal pMac, uint8_t sessionId);
 
 #ifdef FEATURE_WLAN_ESE
 /* Returns whether the current association is a ESE assoc or not */
-bool csr_roam_is_ese_assoc(tpAniSirGlobal pMac, uint8_t sessionId);
+bool csr_roam_is_ese_assoc(tpAniSirGlobal pMac, uint32_t sessionId);
 bool csr_roam_is_ese_ini_feature_enabled(tpAniSirGlobal pMac);
 QDF_STATUS csr_get_tsm_stats(tpAniSirGlobal pMac,
 		tCsrTsmStatsCallback callback,

+ 1 - 1
core/sme/src/csr/csr_api_roam.c

@@ -1580,7 +1580,7 @@ QDF_STATUS csr_create_roam_scan_channel_list(tpAniSirGlobal pMac,
  *
  * Return: true if ese association; false otherwise
  */
-bool csr_roam_is_ese_assoc(tpAniSirGlobal mac_ctx, uint8_t session_id)
+bool csr_roam_is_ese_assoc(tpAniSirGlobal mac_ctx, uint32_t session_id)
 {
 	return mac_ctx->roam.neighborRoamInfo[session_id].isESEAssoc;
 }

+ 2 - 2
core/sme/src/rrm/sme_rrm.c

@@ -1111,13 +1111,13 @@ QDF_STATUS sme_rrm_process_neighbor_report(tpAniSirGlobal pMac, void *pMsgBuf)
 	tpRrmNeighborReportDesc pNeighborReportDesc;
 	uint8_t i = 0;
 	QDF_STATUS qdf_status = QDF_STATUS_SUCCESS;
-	uint8_t sessionId;
+	uint32_t sessionId;
 
 	/* Get the session id */
 	status =
 		csr_roam_get_session_id_from_bssid(pMac,
 			   (struct qdf_mac_addr *) pNeighborRpt->bssId,
-			   (uint32_t *) &sessionId);
+			   &sessionId);
 	if (QDF_IS_STATUS_SUCCESS(status)) {
 #ifdef FEATURE_WLAN_ESE
 		/* Clear the cache for ESE. */