In the function drv_cmd_set_mc_rate, the variable targetRate, used to
store the value parsed from the command from user space, is not
initialized. The variable is assigned value inside a kernel API
kstrtouint that converts the string to an unsigned int. In a certain
case if the kernel API fails, it returns an error code without assigning
any value to the passed parameter. In this scenario, the variable
targetRate, still uninitialized is passed on to function
wlan_hdd_set_mc_rate where it is logged using hdd_debug. As the flow
goes on, it is then again logged using WMA_LOGE(). This might lead to
potential information leak.
Initialize the variable to zero to prevent the mentioned scenario.
Change-Id: Ideec0b1930e994f19ae8a669cd2963db4016eae1
CRs-Fixed: 2226172
In __iw_set_packet_filter_params(), a user controlled length value,
priv_data.length, is used to allocated a buffer. This buffer is then
cast to a struct pointer of struct pkt_filter_cfg type without ensuring
the buffer is large enough to hold the struct. This can lead to a buffer
overread if the user supplied size is smaller than the actual size of the
struct.
Add a sanity check on priv_data.length to ensure that the size is large
enough to hold the struct.
Change-Id: I227856484d4bd7a9b0a16a42e26febbc799f80b5
CRs-Fixed: 2228725
Presently, fw_crash_timeout is disabled as a result of which if
timeout happens for any VDEV related WMI command and device goes
in bad state, no assert or recovery is getting triggered. Due to
this, device crashes at some later point of time at some random
location making debugging difficult.
Enable fw_crash_timeout and trigger recovery if recovery is enabled
otherwise assert.
Change-Id: I9e9e51cba8086bd181be28884c490f0bd77663a8
CRs-Fixed: 2229101
In function update_fils_data, fils_indication->num_variable_data
is the actual length of the data present in the array variable_data.
While accessing variable_data array to copy cache identifier, HESSID
and realm identifiers, the length of the array is not checked and
could lead to OOB access.
Add check to validate remaining data length in variable_data array
before accessing it to copy various fields.
Change-Id: Ifc1f5d55964bcd7fdcc2676ea9c2afede0fe6803
CRs-Fixed: 2231767
As a result of P2P componentization a variety of P2P-related macros
are no longer used, so remove them.
Change-Id: I693c4f11575968ce0aae9f3ecac9e008b0dbf5b9
CRs-Fixed: 2237726
Replace typos "sucess" and "sucessful" with correct spellings
"success" and "successful"
Change-Id: I30746cbab4533da9b052261fa9bb87214188138b
CRs-Fixed: 2237724
The Linux Coding Style frowns upon mixed-case names and so-called
Hungarian notation, so rename fConnected to align with the Coding
Style.
Change-Id: I5987e3c31aed44448a1f1843d8931daa7dfeb0fe
CRs-Fixed: 2237723
Rename typedef tsap_Config_t and the underlying struct sap_Config to
align with the Linux coding standard.
Change-Id: I6e8f8b5ab9555c7781f1acf12a0475902866300c
CRs-Fixed: 2237721
The following structs are obsolete so remove them:
- struct sQcSapreq_wpaie
- struct sQcSapreq_wscie
Change-Id: Ie9fdba59cf31e9a2c5e468183c1328aee439709a
CRs-Fixed: 2237720
qcacld-2.0 to qcacld-3.0 propagation
Beacon does not show RSN IE after disabling/enabling SAP, hence
stations does not connect back while trying to associate in WPA.
While re-enable SAP from the hostapd_cli, the start_bss is called
twice, first from wps_init which does not populate RSNIE and secondly,
through bss_setup which has RSNIE but getting ignored as the BSS is
already started.
Added the RSN IE in case of BSS already started
Change-Id: I2a67156e66e255e7c007a5925cd81b859009114e
CRs-Fixed: 2144429
Add /* fallthrough */ comment in __lim_process_sme_deauth_req
as per linux checkpatch script while processing deauth req for
limSmeState 'eLIM_SME_LINK_EST_STATE'.
Change-Id: I38e0520aaec96e2ba35c916b39e79724c453632f
CRs-Fixed: 2233183
wlan_objmgr_get_vdev_by_macaddr_from_psoc and wlan_objmgr_get_peer
API's definitions have been changed to include pdev_id as an
argument.
Modify the callers of these APIs to include pdev_id as argument.
Change-Id: I3d0de6a0bc1dfefbe1b3cad51ec23f703baaf3ad
CRs-Fixed: 2210728
In hdd_send_association_event() and hdd_send_re_assoc_event(), there is
no check of pBssDesc against NULL which can lead to NULL pointer exception.
Circumvent this issue by adding NULL check.
Change-Id: Ic3a0142b4ea3f058e8d3993fb491d418ddb8f70d
CRs-Fixed: 2232721
Takecare to disable TCP delack internally if GRO is enabled.
This is required as enabling both will have adverse effect with
smaller window size and noisy scenario.
Change-Id: If91236620d87287c9b71901e9d8e3d176eebc648
CRs-Fixed: 2172652
Change I8e1b62cd9586f5b2be7acb863a106d2486be1b35 used unassigned
member dp_handle of wlan_objmgr_psoc, that causing failure on DP.
Assign dp_handle properly to avoid it.
CRs-Fixed: 2237072
Change-Id: If230b8a24f5ac9d26ac27f89779c7669cdee5455
Add /* fallthrough */ comment in sme_qos_add_ts_failure_fnp
as per linux checkpatch script in case of reason
SME_QOS_REASON_REQ_SUCCESS of flow request.
Change-Id: I6ea942e53cd6f0828dbe55cfdd77ecf75cf1cdbb
CRs-Fixed: 2233176
wma_is_service_enabled can't get valid service bitmap if call in
hdd_update_pmo_config, use psoc_ctx->caps.unified_wow instead to check
pattern id per vdev and legacy d0 wow capability.
Change-Id: If7bf316f482c49253fc4b95b94e172727b27ffd1
CRs-Fixed: 2225847
When do re-association, there is obsolete data exists in policy manager
until hdd_association_completion_handler updates the active session.
If check sap restart before this, will access the wrong data.
Change-Id: Ie62f86a5d523e70b6bb81b500bd358b63ae90ea8
CRs-Fixed: 2231675
In the API wma_process_pdev_hw_mode_trans_ind
the host doesnt check the upper limit of
num_vdev_mac_entries received from the firmware,
and fills the same to the host structure
hw_mode_trans_ind, which may cause OOB write.
Fix is to check for the max vdev supported in the
same API and return if the condition is false.
Change-Id: I54a9e12f777b87b49057d6c97c06ab71b9ad1d77
CRs-Fixed: 2221965
To avoid out-of-bounds access of mem_map_table from htt_rx_hash_deinit
, allocate mem_map_table size the same as maximum number of hash
entries, which is RX_NUM_HASH_BUCKETS * RX_ENTRIES_SIZE.
Change-Id: If25f97b47350196ceb2e8c60e7d5430a1484a01d
CRs-Fixed: 2214158
NAPI APIs in HDD are platform specific. So make these API's
conditionally compiled.
Change-Id: Id87c11da13f096d4f9ff735bbd98dcea23d52310
CRs-Fixed: 2235978
Initialize packet filter clear rule on stack properly to avoid
using un-initialized member variables.
Change-Id: I03b129e7660ed761b03ac163fdb3e7eee58ec034
CRs-Fixed: 2119208
In the function wma_set_epno_network_list,
req->networks[i].ssid.ssId is copied into the destination
params->networks[i].ssid.mac_ssid. But the ssid length is not
considered while copying and WMI_MAC_MAX_SSID_LENGTH is used as
the length for copying. This might result in possible buffer
overread if the ssid length is not WMI_MAC_MAX_SSID_LENGTH.
Similar issue is seen in wma_pno_start also.
Use pno->aNetworks[i].ssId.length as the size to mem copy the
ssid to the destination ssid buffer.
Change-Id: Id3f579da97e398663b7d583f5f46d4671eabeae3
CRs-Fixed: 2233682
