Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6ad52e5a authored by Vinod Kumar Myadam's avatar Vinod Kumar Myadam
Browse files

qcacld-3.0: Sanity check for session_id in roam 

For session_id is not have sanity check, an OOB would happen
leads to crash.

Added Sanity checks for session_id in roam functions and
return failure if session_id is equals to NULL or MAX value.

Change-Id: I033c6567f53ead2a721882e9b44f3d0bcb58084d
CRs-Fixed: 3149880
parent c0bcc19a

core/sme/src/csr/csr_api_roam.c

+16 −0
Original line number Diff line number Diff line
@@ -8195,6 +8195,12 @@ csr_roam_reassoc(struct mac_context *mac_ctx, uint32_t session_id, 
		sme_err("No profile specified");

		return QDF_STATUS_E_FAILURE;

	}













	if (!session) {













		sme_err("Session_id invalid %d", session_id);













		return QDF_STATUS_E_FAILURE;













	}



























	sme_debug(















		"called  BSSType = %s (%d) authtype = %d  encryType = %d",















		sme_bss_type_to_string(profile->BSSType),










@@ -20340,6 +20346,11 @@ static bool csr_is_conn_allow_2g_band(struct mac_context *mac_ctx,













	sap_session_id = csr_find_session_by_type(mac_ctx, QDF_SAP_MODE);















	if (WLAN_UMAC_VDEV_ID_MAX != sap_session_id) {















		sap_session = CSR_GET_SESSION(mac_ctx, sap_session_id);













		if (!sap_session) {













			sme_err("Session_id invalid %d", sap_session_id);













			return false;













		}



























		if (0 != sap_session->bssParams.operation_chan_freq &&















		    sap_session->bssParams.operation_chan_freq != ch_freq) {















			QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,










@@ -20378,6 +20389,11 @@ static bool csr_is_conn_allow_5g_band(struct mac_context *mac_ctx,













	p2pgo_session_id = csr_find_session_by_type(mac_ctx, QDF_P2P_GO_MODE);















	if (WLAN_UMAC_VDEV_ID_MAX != p2pgo_session_id) {















		p2pgo_session = CSR_GET_SESSION(mac_ctx, p2pgo_session_id);













		if (!p2pgo_session) {













			sme_err("Session_id invalid %d", p2pgo_session_id);













			return false;













		}



























		if (0 != p2pgo_session->bssParams.operation_chan_freq &&















		    eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED !=















		    p2pgo_session->connectState &&

























core/sme/src/csr/csr_api_scan.c



+2
−2




























Original line number
Diff line number
Diff line








@@ -2629,8 +2629,7 @@ void csr_init_occupied_channels_list(struct mac_context *mac_ctx,













	struct wlan_channel *chan;















	struct wlan_objmgr_vdev *vdev;





























	tpCsrNeighborRoamControlInfo neighbor_roam_info =













		&mac_ctx->roam.neighborRoamInfo[sessionId];













	tpCsrNeighborRoamControlInfo neighbor_roam_info;















	tCsrRoamConnectedProfile *profile = NULL;















	QDF_STATUS status;

























@@ -2639,6 +2638,7 @@ void csr_init_occupied_channels_list(struct mac_context *mac_ctx,













		sme_debug("Invalid session");















		return;















	}













	neighbor_roam_info = &mac_ctx->roam.neighborRoamInfo[sessionId];















	if (neighbor_roam_info->cfgParams.specific_chan_info.numOfChannels) {















		/*















		 * Ini file contains neighbor scan channel list, hence NO need

































core/sme/src/csr/csr_host_scan_roam.c



+9
−2




























Original line number
Diff line number
Diff line















/*















 * Copyright (c) 2016-2020 The Linux Foundation. All rights reserved.













 * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.















 *















 * Permission to use, copy, modify, and/or distribute this software for















 * any purpose with or without fee is hereby granted, provided that the










@@ -504,12 +505,18 @@ void csr_neighbor_roam_request_handoff(struct mac_context *mac_ctx,













		uint8_t session_id)















{















	struct csr_roam_info *roam_info;













	tpCsrNeighborRoamControlInfo neighbor_roam_info =













		&mac_ctx->roam.neighborRoamInfo[session_id];













	struct csr_roam_session *session = CSR_GET_SESSION(mac_ctx, session_id);













	tpCsrNeighborRoamControlInfo neighbor_roam_info;















	tCsrNeighborRoamBSSInfo handoff_node;















	uint32_t roamid = 0;















	QDF_STATUS status;





























	if (!session) {













		sme_err("Session_id invalid %d", session_id);













		return;













	}



























	neighbor_roam_info = &mac_ctx->roam.neighborRoamInfo[session_id];















	QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_DEBUG, "%s session_id=%d",















		  __func__, session_id);

















































core/sme/src/csr/csr_neighbor_roam.c



+9
−2




























Original line number
Diff line number
Diff line















/*















 * Copyright (c) 2011-2020 The Linux Foundation. All rights reserved.













 * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.















 *















 * Permission to use, copy, modify, and/or distribute this software for















 * any purpose with or without fee is hereby granted, provided that the










@@ -127,8 +128,14 @@ QDF_STATUS csr_neighbor_roam_update_fast_roaming_enabled(struct mac_context *mac













						const bool fast_roam_enabled)















{















	QDF_STATUS qdf_status = QDF_STATUS_SUCCESS;













	tpCsrNeighborRoamControlInfo neighbor_roam_info =













		&mac_ctx->roam.neighborRoamInfo[session_id];













	tpCsrNeighborRoamControlInfo neighbor_roam_info;













	struct csr_roam_session *session = CSR_GET_SESSION(mac_ctx, session_id);



























	if (!session) {













		sme_err("session_id invalid %d", session_id);













		return QDF_STATUS_E_FAILURE;













	}













	neighbor_roam_info = &mac_ctx->roam.neighborRoamInfo[session_id];































	switch (neighbor_roam_info->neighborRoamState) {















	case eCSR_NEIGHBOR_ROAM_STATE_CONNECTED:

































core/sme/src/csr/csr_roam_preauth.c



+28
−8




























Original line number
Diff line number
Diff line















/*















 * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.













 * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.















 *















 * Permission to use, copy, modify, and/or distribute this software for















 * any purpose with or without fee is hereby granted, provided that the










@@ -203,13 +204,20 @@ QDF_STATUS csr_neighbor_roam_preauth_rsp_handler(struct mac_context *mac_ctx,













						 uint8_t session_id,















						 QDF_STATUS lim_status)















{













	tpCsrNeighborRoamControlInfo neighbor_roam_info =













		&mac_ctx->roam.neighborRoamInfo[session_id];













	tpCsrNeighborRoamControlInfo neighbor_roam_info;













	struct csr_roam_session *session = CSR_GET_SESSION(mac_ctx, session_id);















	QDF_STATUS status = QDF_STATUS_SUCCESS;















	QDF_STATUS preauth_processed = QDF_STATUS_SUCCESS;















	tpCsrNeighborRoamBSSInfo preauth_rsp_node = NULL;















	uint8_t reason;





























	if (!session) {













		sme_err("session_id invalid %d", session_id);













		preauth_processed = QDF_STATUS_E_FAILURE;













		goto DEQ_PREAUTH;













	}



























	neighbor_roam_info = &mac_ctx->roam.neighborRoamInfo[session_id];















	if (false == neighbor_roam_info->FTRoamInfo.preauthRspPending) {















		/*















		 * This can happen when we disconnect immediately










@@ -378,11 +386,18 @@ static QDF_STATUS csr_neighbor_roam_add_preauth_fail(struct mac_context *mac_ctx













			uint8_t session_id, tSirMacAddr bssid)















{















	uint8_t i = 0;













	tpCsrNeighborRoamControlInfo neighbor_roam_info =













		&mac_ctx->roam.neighborRoamInfo[session_id];













	uint8_t num_mac_addr = neighbor_roam_info->FTRoamInfo.preAuthFailList.













				numMACAddress;













	tpCsrNeighborRoamControlInfo neighbor_roam_info;













	struct csr_roam_session *session = CSR_GET_SESSION(mac_ctx, session_id);













	uint8_t num_mac_addr;





























	if (!session) {













		sme_err("session_id invalid %d", session_id);













		return QDF_STATUS_E_FAILURE;













	}



























	neighbor_roam_info = &mac_ctx->roam.neighborRoamInfo[session_id];













	num_mac_addr = neighbor_roam_info->FTRoamInfo.preAuthFailList.













			numMACAddress;















	sme_warn("Added BSSID " QDF_MAC_ADDR_FMT " to Preauth failed list",















		QDF_MAC_ADDR_REF(bssid));


























@@ -735,12 +750,17 @@ void csr_roam_ft_pre_auth_rsp_processor(struct mac_context *mac_ctx,













QDF_STATUS csr_neighbor_roam_issue_preauth_req(struct mac_context *mac_ctx,















						      uint8_t session_id)















{













	tpCsrNeighborRoamControlInfo neighbor_roam_info =













		&mac_ctx->roam.neighborRoamInfo[session_id];













	tpCsrNeighborRoamControlInfo neighbor_roam_info;















	QDF_STATUS status = QDF_STATUS_SUCCESS;















	tpCsrNeighborRoamBSSInfo neighbor_bss_node;













	struct csr_roam_session *session = CSR_GET_SESSION(mac_ctx, session_id);





























	if (!session) {













		sme_err("session_id invalid %d", session_id);













		return QDF_STATUS_E_FAILURE;













	}





























	neighbor_roam_info = &mac_ctx->roam.neighborRoamInfo[session_id];















	if (false != neighbor_roam_info->FTRoamInfo.preauthRspPending) {















		/* This must not be true here */















		QDF_ASSERT(neighbor_roam_info->FTRoamInfo.preauthRspPending ==