Browse Source

qcacld-3.0: Incorrect validation of RSNXE cap bits

Currently, cap_mask contains the bitmap to check if any bits
other than SAE_H2E, SAE_PK, SECURE_LTF, SECURE_RTT,
PROT_RANGE_NEGOTIOATION are set in RSNXE capabilities.
But if the cap length is non-zero, the cap_mask wrongly indicates
that some bit is set in the capabilities other than the above
mentioned features as first 4-bits are used for length.
Skip validating the first 4-bits as these are reserved for
cap length.

Change-Id: I3736479e7c580425f8d340cb5bd815836c54d5ce
CRs-Fixed: 3270051
Srinivas Dasari 2 years ago
parent
commit
ce7965e1c3
1 changed files with 1 additions and 1 deletions
  1. 1 1
      core/mac/src/pe/lim/lim_process_sme_req_messages.c

+ 1 - 1
core/mac/src/pe/lim/lim_process_sme_req_messages.c

@@ -3695,7 +3695,7 @@ lim_is_rsnxe_cap_set(struct mac_context *mac_ctx,
 	 * TODO: If spec supports more than this range in future, this needs to
 	 * be an array to hold the complete bitmap/bitmask.
 	 */
-	cap_mask = ~(WLAN_CRYPTO_RSNX_CAP_SAE_H2E |
+	cap_mask = ~(0xF | WLAN_CRYPTO_RSNX_CAP_SAE_H2E |
 		     WLAN_CRYPTO_RSNX_CAP_SAE_PK |
 		     WLAN_CRYPTO_RSNX_CAP_SECURE_LTF |
 		     WLAN_CRYPTO_RSNX_CAP_SECURE_RTT |