Browse Source

qcacmn: Update missing ie pointers in util_scan_copy_beacon_data

util_scan_copy_beacon_data copies beacon and updates ie
pointers for the cache entry. However, two of the ie pointers
listed below are not updated:
 1) hecap_6g - pointer to he 6ghz cap ie.
 2) srp - pointer to spatial reuse parameter sub extended ie.

These non updated pointers will cause use after free issues
if the parent scan entry is freed.

Update ie pointers for hecap_6g and srp.

Change-Id: I6d0a6129941e3dc1267404a4191ab368c013a102
CRs-Fixed: 2862607
Rakshith Suresh Patkar 4 years ago
parent
commit
cb5da5d67e
1 changed files with 2 additions and 0 deletions
  1. 2 0
      umac/scan/dispatcher/inc/wlan_scan_utils_api.h

+ 2 - 0
umac/scan/dispatcher/inc/wlan_scan_utils_api.h

@@ -716,7 +716,9 @@ util_scan_copy_beacon_data(struct scan_cache_entry *new_entry,
 	ie_lst->bwnss_map = conv_ptr(ie_lst->bwnss_map, old_ptr, new_ptr);
 	ie_lst->mdie = conv_ptr(ie_lst->mdie, old_ptr, new_ptr);
 	ie_lst->hecap = conv_ptr(ie_lst->hecap, old_ptr, new_ptr);
+	ie_lst->hecap_6g = conv_ptr(ie_lst->hecap_6g, old_ptr, new_ptr);
 	ie_lst->heop = conv_ptr(ie_lst->heop, old_ptr, new_ptr);
+	ie_lst->srp = conv_ptr(ie_lst->srp, old_ptr, new_ptr);
 	ie_lst->fils_indication = conv_ptr(ie_lst->fils_indication,
 					   old_ptr, new_ptr);
 	ie_lst->esp = conv_ptr(ie_lst->esp, old_ptr, new_ptr);