samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Fix out-of-bound in wlan_mlo_parse_bcn_prbresp_t2lm_ie

Browse Source 
Currently, In the MLO t2lm API, wlan_mlo_parse_bcn_prbresp_t2lm_ie
is missing frame boundary checks which may lead to out-of-bound
reads if the lengths are not checked by the caller.

Fix is, while parsing t2lm ie pass the frame length and add
check for frame boundary.

CRs-Fixed: 3704739
Change-Id: If3068db3489ee1c9a9da4945407598e27e3ca276
This commit is contained in:
Krupali Dhanvijay
2024-02-05 16:18:06 +05:30
committed by Ravindra Konda
parent a1aaa5c775
commit f323c32b7d
4 changed files with 60 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
umac/scan/dispatcher/inc/wlan_scan_utils_api.h
View File

@@ -1647,12 +1647,26 @@ util_scan_entry_t2lm(struct scan_cache_entry *scan_entry)
{
return scan_entry->ie_list.t2lm[0];
}
/**
* util_scan_entry_t2lm_len() - API to get t2lm IE length
* @scan_entry: scan entry
*
* Return, Length or 0 if ie is not present
*/
uint32_t util_scan_entry_t2lm_len(struct scan_cache_entry *scan_entry);
#else
static inline uint8_t*
util_scan_entry_t2lm(struct scan_cache_entry *scan_entry)
{
return NULL;
}
static inline uint32_t
util_scan_entry_t2lm_len(struct scan_cache_entry *scan_entry)
{
return 0;
}
#endif
/**

19
umac/scan/dispatcher/src/wlan_scan_utils_api.c
View File

@@ -126,6 +126,25 @@ util_get_last_scan_time(struct wlan_objmgr_vdev *vdev)
return 0;
}
#ifdef WLAN_FEATURE_11BE_MLO
uint32_t util_scan_entry_t2lm_len(struct scan_cache_entry *scan_entry)
{
int i = 0;
uint32_t len = 0;
if (!scan_entry || !scan_entry->ie_list.t2lm[0])
return 0;
for (i = 0; i < WLAN_MAX_T2LM_IE; i++) {
if (scan_entry->ie_list.t2lm[i])
len += scan_entry->ie_list.t2lm[i][TAG_LEN_POS] +
sizeof(struct ie_header);
}
return len;
}
#endif
bool util_is_rsnxe_h2e_capable(const uint8_t *rsnxe)
{
const uint8_t *rsnxe_caps;