Browse Source

qcacld-3.0: Remove code handling blacklist and whitelist OUI

This is an older implmenetation of handling blacklist and whitelist
OUI's. Hostapd doesn't send this information in start_ap now. There
is a possible out of bound memory access happening while parsing an
IE with this code. Remove the code to avoid security risk.

Remove redundant code handling blacklist and whitelist OUI IE's.

Change-Id: Ib16d26d6766bcffb53de34dca77073a3e986eee2
CRs-Fixed: 2239897
Nachiket Kukade 6 years ago
parent
commit
ef86101690
2 changed files with 0 additions and 59 deletions
  1. 0 5
      core/hdd/inc/qc_sap_ioctl.h
  2. 0 54
      core/hdd/src/wlan_hdd_hostapd.c

+ 0 - 5
core/hdd/inc/qc_sap_ioctl.h

@@ -27,11 +27,6 @@
 
 typedef uint8_t qcmacaddr[QCSAP_ADDR_LEN];
 
-struct qc_mac_acl_entry {
-	qcmacaddr addr;
-	int vlan_id;
-};
-
 /*
  * Channel List Info
  */

+ 0 - 54
core/hdd/src/wlan_hdd_hostapd.c

@@ -4268,7 +4268,6 @@ int wlan_hdd_cfg80211_start_bss(struct hdd_adapter *adapter,
 	tpWLAN_SAPEventCB pSapEventCallback;
 	struct hdd_hostapd_state *hostapd_state;
 	mac_handle_t mac_handle;
-	struct qc_mac_acl_entry *acl_entry = NULL;
 	int32_t i;
 	struct hdd_config *iniConfig;
 	struct hdd_context *hdd_ctx = WLAN_HDD_GET_CTX(adapter);
@@ -4680,59 +4679,6 @@ int wlan_hdd_cfg80211_start_bss(struct hdd_adapter *adapter,
 		pConfig->cc_switch_mode = iniConfig->WlanMccToSccSwitchMode;
 #endif
 
-	pIe = wlan_get_vendor_ie_ptr_from_oui(BLACKLIST_OUI_TYPE,
-					      WPA_OUI_TYPE_SIZE, pBeacon->tail,
-					      pBeacon->tail_len);
-
-	/* pIe for black list is following form:
-	 * type    : 1 byte
-	 * length  : 1 byte
-	 * OUI     : 4 bytes
-	 * acl type : 1 byte
-	 * no of mac addr in black list: 1 byte
-	 * list of mac_acl_entries: variable, 6 bytes per mac
-	 * address + sizeof(int) for vlan id
-	 */
-	if ((pIe != NULL) && (pIe[1] != 0)) {
-		pConfig->SapMacaddr_acl = pIe[6];
-		pConfig->num_deny_mac = pIe[7];
-		hdd_debug("acl type = %d no deny mac = %d", pIe[6], pIe[7]);
-		if (pConfig->num_deny_mac > MAX_ACL_MAC_ADDRESS)
-			pConfig->num_deny_mac = MAX_ACL_MAC_ADDRESS;
-		acl_entry = (struct qc_mac_acl_entry *)(pIe + 8);
-		for (i = 0; i < pConfig->num_deny_mac; i++) {
-			qdf_mem_copy(&pConfig->deny_mac[i], acl_entry->addr,
-				     sizeof(qcmacaddr));
-			acl_entry++;
-		}
-	}
-	pIe = wlan_get_vendor_ie_ptr_from_oui(WHITELIST_OUI_TYPE,
-			WPA_OUI_TYPE_SIZE, pBeacon->tail,
-			pBeacon->tail_len);
-
-	/* pIe for white list is following form:
-	 * type    : 1 byte
-	 * length  : 1 byte
-	 * OUI     : 4 bytes
-	 * acl type : 1 byte
-	 * no of mac addr in white list: 1 byte
-	 * list of mac_acl_entries: variable, 6 bytes per mac
-	 * address + sizeof(int) for vlan id
-	 */
-	if ((pIe != NULL) && (pIe[1] != 0)) {
-		pConfig->SapMacaddr_acl = pIe[6];
-		pConfig->num_accept_mac = pIe[7];
-		hdd_debug("acl type = %d no accept mac = %d",
-		       pIe[6], pIe[7]);
-		if (pConfig->num_accept_mac > MAX_ACL_MAC_ADDRESS)
-			pConfig->num_accept_mac = MAX_ACL_MAC_ADDRESS;
-		acl_entry = (struct qc_mac_acl_entry *)(pIe + 8);
-		for (i = 0; i < pConfig->num_accept_mac; i++) {
-			qdf_mem_copy(&pConfig->accept_mac[i], acl_entry->addr,
-				     sizeof(qcmacaddr));
-			acl_entry++;
-		}
-	}
 	if (!(ssid && qdf_str_len(PRE_CAC_SSID) == ssid_len &&
 	      (0 == qdf_mem_cmp(ssid, PRE_CAC_SSID, ssid_len)))) {
 		pIe = wlan_get_ie_ptr_from_eid(WLAN_EID_SUPP_RATES,