From 704ecb7fa2a151df19785532ff5429dd4619d5d5 Mon Sep 17 00:00:00 2001 From: Shwetha Goravanahalli Kemparaju Date: Mon, 25 Sep 2023 12:58:35 +0530 Subject: [PATCH 1/2] qcacmn: Fix OOB issue Changes to fix OOB issue seen util_scan_parse_beacon_frame. CRs-Fixed: 3582496 Change-Id: I53244be54d31e87b55d0b44ce94315c8001f417d --- umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h | 4 ++++ umac/scan/dispatcher/src/wlan_scan_utils_api.c | 5 ++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h b/umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h index 88b5129764ec..bd8814cda7ce 100644 --- a/umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h +++ b/umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h @@ -1,5 +1,6 @@ /* * Copyright (c) 2017-2020 The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -215,6 +216,9 @@ #define WLAN_BSS_MEMBERSHIP_SELECTOR_SAE_H2E 123 #define WLAN_BSS_MEMBERSHIP_SELECTOR_HE_PHY 122 +#define WLAN_MIN_HECAP_IE_LEN 22 +#define WLAN_MAX_HECAP_IE_LEN 55 + #define WLAN_CHAN_IS_5GHZ(chanidx) \ ((chanidx > 30) ? true : false) #define WLAN_CHAN_IS_2GHZ(chanidx) \ diff --git a/umac/scan/dispatcher/src/wlan_scan_utils_api.c b/umac/scan/dispatcher/src/wlan_scan_utils_api.c index 6c11c2205115..172dbcb55136 100644 --- a/umac/scan/dispatcher/src/wlan_scan_utils_api.c +++ b/umac/scan/dispatcher/src/wlan_scan_utils_api.c @@ -1,6 +1,6 @@ /* * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved. - * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -754,6 +754,9 @@ util_scan_parse_extn_ie(struct scan_cache_entry *scan_params, scan_params->ie_list.srp = (uint8_t *)ie; break; case WLAN_EXTN_ELEMID_HECAP: + if ((extn_ie->ie_len < WLAN_MIN_HECAP_IE_LEN) || + (extn_ie->ie_len > WLAN_MAX_HECAP_IE_LEN)) + return QDF_STATUS_E_INVAL; scan_params->ie_list.hecap = (uint8_t *)ie; break; case WLAN_EXTN_ELEMID_HEOP: From c5b9369b6da5e6f0eb2e4f59e4417cceb219d14d Mon Sep 17 00:00:00 2001 From: Surya Prakash Sivaraj Date: Fri, 1 Dec 2023 10:16:57 +0530 Subject: [PATCH 2/2] qcacmn: Add sanity check to fix OOB issue Add sanity check to fix OOB issue while generating scan entries for beacon CRs-Fixed: 3591858 Change-Id: I35b362bc89ab10fa2d2d6660263c726692384e07 --- umac/scan/dispatcher/src/wlan_scan_utils_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/umac/scan/dispatcher/src/wlan_scan_utils_api.c b/umac/scan/dispatcher/src/wlan_scan_utils_api.c index 172dbcb55136..b8b2f87c9ea2 100644 --- a/umac/scan/dispatcher/src/wlan_scan_utils_api.c +++ b/umac/scan/dispatcher/src/wlan_scan_utils_api.c @@ -2011,7 +2011,7 @@ util_scan_parse_beacon_frame(struct wlan_objmgr_pdev *pdev, mbssid_ie = util_scan_find_ie(WLAN_ELEMID_MULTIPLE_BSSID, (uint8_t *)&bcn->ie, ie_len); if (mbssid_ie) { - if (mbssid_ie[1] <= 0) { + if (mbssid_ie[1] < 4) { scm_debug("MBSSID IE length is wrong %d", mbssid_ie[1]); return status;