Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d970d231 authored by Jianmin Zhu's avatar Jianmin Zhu Committed by Madan Koyyalamudi
Browse files

qcacld-3.0: Fix array OOB for duplicate rate 

Some IoT AP may have duplicate rates in supported rates and
extended rates in beacon, need filter them when populate peer 11a/11b
rates during connect/roaming, or array out of bound issue will happen.

Change-Id: I685e8c07ee147296bfa22742dad4210e7fa02c4a
CRs-Fixed: 3048142
parent fa2d7434

core/mac/src/pe/lim/lim_assoc_utils.c

+23 −17
Original line number Diff line number Diff line
@@ -1606,7 +1606,6 @@ QDF_STATUS lim_populate_peer_rate_set(struct mac_context *mac, 
	for (i = 0; i < tempRateSet.numRates; i++) {

		min = 0;

		val = 0xff;

		isArate = 0;

		for (j = 0; (j < tempRateSet.numRates) &&

		     (j < WLAN_SUPPORTED_RATES_IE_MAX_LEN); j++) {

			if ((uint32_t)(tempRateSet.rate[j] & 0x7f) <
@@ -1615,8 +1614,22 @@ QDF_STATUS lim_populate_peer_rate_set(struct mac_context *mac, 
				min = j;

			}

		}

		if (sirIsArate(tempRateSet.rate[min] & 0x7f))

		if (sirIsArate(tempRateSet.rate[min] & 0x7f)) {

			isArate = 1;

		} else if (sirIsBrate(tempRateSet.rate[min] & 0x7f)) {

			isArate = 0;

		} else {

			pe_debug("%d is neither 11a nor 11b rate",

				 tempRateSet.rate[min]);

			tempRateSet.rate[min] = 0xff;

			continue;

		}

		if (tempRateSet.rate[min] == pRates->llaRates[aRateIndex] ||

		    tempRateSet.rate[min] == pRates->llbRates[bRateIndex]) {

			pe_debug("Duplicate rate: %d", tempRateSet.rate[min]);

			tempRateSet.rate[min] = 0xff;

			continue;

		}

		/*

		 * HAL needs to know whether the rate is basic rate or not,

		 * as it needs to update the response rate table accordingly.
@@ -1624,23 +1637,16 @@ QDF_STATUS lim_populate_peer_rate_set(struct mac_context *mac, 
		 * can be used for sending control frames. HAL updates the

		 * response rate table whenever basic rate set is changed.

		 */

		if (basicOnly) {

			if (tempRateSet.rate[min] & 0x80) {

				if (isArate)

					pRates->llaRates[aRateIndex++] =

						tempRateSet.rate[min];

				else

					pRates->llbRates[bRateIndex++] =

						tempRateSet.rate[min];

		if (basicOnly && !(tempRateSet.rate[min] & 0x80)) {

			tempRateSet.rate[min] = 0xff;

			continue;

		}

		} else {

			if (isArate)

		if (isArate && aRateIndex < SIR_NUM_11A_RATES)

			pRates->llaRates[aRateIndex++] =

					tempRateSet.rate[min];

			else

		else if (bRateIndex < SIR_NUM_11B_RATES)

			pRates->llbRates[bRateIndex++] =

					tempRateSet.rate[min];

		}

		tempRateSet.rate[min] = 0xff;

	}