samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Update missing ie pointers in util_scan_copy_beacon_data

Browse Source 
util_scan_copy_beacon_data copies beacon and updates ie
pointers for the cache entry. However, two of the ie pointers
listed below are not updated:
 1) hecap_6g - pointer to he 6ghz cap ie.
 2) srp - pointer to spatial reuse parameter sub extended ie.

These non updated pointers will cause use after free issues
if the parent scan entry is freed.

Update ie pointers for hecap_6g and srp.

Change-Id: I6d0a6129941e3dc1267404a4191ab368c013a102
CRs-Fixed: 2862607
This commit is contained in:
Rakshith Suresh Patkar
2021-02-03 22:13:07 +05:30
committed by snandini
parent 14bfc9057c
commit cb5da5d67e
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
umac/scan/dispatcher/inc/wlan_scan_utils_api.h
View File

@@ -716,7 +716,9 @@ util_scan_copy_beacon_data(struct scan_cache_entry *new_entry,
ie_lst->bwnss_map = conv_ptr(ie_lst->bwnss_map, old_ptr, new_ptr);
ie_lst->mdie = conv_ptr(ie_lst->mdie, old_ptr, new_ptr);
ie_lst->hecap = conv_ptr(ie_lst->hecap, old_ptr, new_ptr);
ie_lst->hecap_6g = conv_ptr(ie_lst->hecap_6g, old_ptr, new_ptr);
ie_lst->heop = conv_ptr(ie_lst->heop, old_ptr, new_ptr);
ie_lst->srp = conv_ptr(ie_lst->srp, old_ptr, new_ptr);
ie_lst->fils_indication = conv_ptr(ie_lst->fils_indication,
old_ptr, new_ptr);
ie_lst->esp = conv_ptr(ie_lst->esp, old_ptr, new_ptr);