qcacld-3.0: Make data length as zero whenever we free the data
qcacld-2.0 to qcacld-3.0 propagation
In limSendSmeJoinReassocRsp API, assoc req, assoc rsp, ricData, tspecIes
are sent to SME layer if corresponding pointer in psessionEntry is
not NULL. There is bug here where the pointer is NULL but the length is
non zero. Because of this data is copied at incorrect offset and data
at SME layer is not at right offset leading to corrupted IE in
next re-assoc request.
Fix this by making length as zero whenever we free the data.
Change-Id: I4ba4ff49e56bc2f2758d869eae8ff9370b0c0489
CRs-Fixed: 932712
diff --git a/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c b/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c
index a73fa87..be37a64 100644
--- a/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c
+++ b/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c
@@ -381,6 +381,7 @@
if (session_entry->ricData != NULL) {
cdf_mem_free(session_entry->ricData);
session_entry->ricData = NULL;
+ session_entry->RICDataLen = 0;
}
if (assoc_rsp->ricPresent) {
session_entry->RICDataLen =
@@ -429,6 +430,7 @@
if (session_entry->tspecIes != NULL) {
cdf_mem_free(session_entry->tspecIes);
session_entry->tspecIes = NULL;
+ session_entry->tspecLen = 0;
}
if (assoc_rsp->tspecPresent) {
lim_log(mac_ctx, LOG1, FL("Tspec EID present in assoc rsp"));
@@ -745,6 +747,7 @@
"and setting NULL"));
cdf_mem_free(session_entry->assocRsp);
session_entry->assocRsp = NULL;
+ session_entry->assocRspLen = 0;
}
session_entry->assocRsp = cdf_mem_malloc(frame_len);
diff --git a/core/mac/src/pe/lim/lim_process_beacon_frame.c b/core/mac/src/pe/lim/lim_process_beacon_frame.c
index 18c05fd..6d80751 100644
--- a/core/mac/src/pe/lim/lim_process_beacon_frame.c
+++ b/core/mac/src/pe/lim/lim_process_beacon_frame.c
@@ -150,6 +150,7 @@
if (session->beacon != NULL) {
cdf_mem_free(session->beacon);
session->beacon = NULL;
+ session->bcnLen = 0;
}
session->bcnLen = WMA_GET_RX_PAYLOAD_LEN(rx_pkt_info);
session->beacon = cdf_mem_malloc(session->bcnLen);
diff --git a/core/mac/src/pe/lim/lim_process_probe_rsp_frame.c b/core/mac/src/pe/lim/lim_process_probe_rsp_frame.c
index 0096b48..1cfd743 100644
--- a/core/mac/src/pe/lim/lim_process_probe_rsp_frame.c
+++ b/core/mac/src/pe/lim/lim_process_probe_rsp_frame.c
@@ -161,6 +161,7 @@
if (session_entry->beacon != NULL) {
cdf_mem_free(session_entry->beacon);
session_entry->beacon = NULL;
+ session_entry->bcnLen = 0;
}
session_entry->bcnLen =
WMA_GET_RX_PAYLOAD_LEN(rx_Packet_info);
diff --git a/core/mac/src/pe/lim/lim_send_management_frames.c b/core/mac/src/pe/lim/lim_send_management_frames.c
index 50884de..e33d95b 100644
--- a/core/mac/src/pe/lim/lim_send_management_frames.c
+++ b/core/mac/src/pe/lim/lim_send_management_frames.c
@@ -2358,6 +2358,7 @@
if (NULL != pe_session->assocReq) {
cdf_mem_free(pe_session->assocReq);
pe_session->assocReq = NULL;
+ pe_session->assocReqLen = 0;
}
if (ft_ies_length) {
pe_session->assocReq = cdf_mem_malloc(ft_ies_length);
diff --git a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
index 326dfc7..470f119 100644
--- a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
+++ b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
@@ -271,48 +271,53 @@
sme_join_rsp->beaconLength);
cdf_mem_free(session_entry->beacon);
session_entry->beacon = NULL;
+ session_entry->bcnLen = 0;
#ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
lim_log(mac_ctx, LOG1, FL("Beacon=%d"),
- session_entry->bcnLen);
+ sme_join_rsp->beaconLength);
#endif
}
if (session_entry->assocReq != NULL) {
sme_join_rsp->assocReqLength =
session_entry->assocReqLen;
cdf_mem_copy(sme_join_rsp->frames +
- session_entry->bcnLen, session_entry->assocReq,
+ sme_join_rsp->beaconLength,
+ session_entry->assocReq,
sme_join_rsp->assocReqLength);
cdf_mem_free(session_entry->assocReq);
session_entry->assocReq = NULL;
+ session_entry->assocReqLen = 0;
#ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
lim_log(mac_ctx,
LOG1, FL("AssocReq=%d"),
- session_entry->assocReqLen);
+ sme_join_rsp->assocReqLength);
#endif
}
if (session_entry->assocRsp != NULL) {
sme_join_rsp->assocRspLength =
session_entry->assocRspLen;
cdf_mem_copy(sme_join_rsp->frames +
- session_entry->bcnLen +
- session_entry->assocReqLen,
+ sme_join_rsp->beaconLength +
+ sme_join_rsp->assocReqLength,
session_entry->assocRsp,
sme_join_rsp->assocRspLength);
cdf_mem_free(session_entry->assocRsp);
session_entry->assocRsp = NULL;
+ session_entry->assocRspLen = 0;
}
#ifdef WLAN_FEATURE_VOWIFI_11R
if (session_entry->ricData != NULL) {
sme_join_rsp->parsedRicRspLen =
session_entry->RICDataLen;
cdf_mem_copy(sme_join_rsp->frames +
- session_entry->bcnLen +
- session_entry->assocReqLen +
- session_entry->assocRspLen,
+ sme_join_rsp->beaconLength +
+ sme_join_rsp->assocReqLength +
+ sme_join_rsp->assocRspLength,
session_entry->ricData,
sme_join_rsp->parsedRicRspLen);
cdf_mem_free(session_entry->ricData);
session_entry->ricData = NULL;
+ session_entry->RICDataLen = 0;
lim_log(mac_ctx, LOG1, FL("RicLength=%d"),
sme_join_rsp->parsedRicRspLen);
}
@@ -322,22 +327,23 @@
sme_join_rsp->tspecIeLen =
session_entry->tspecLen;
cdf_mem_copy(sme_join_rsp->frames +
- session_entry->bcnLen +
- session_entry->assocReqLen +
- session_entry->assocRspLen +
- session_entry->RICDataLen,
+ sme_join_rsp->beaconLength +
+ sme_join_rsp->assocReqLength +
+ sme_join_rsp->assocRspLength +
+ sme_join_rsp->parsedRicRspLen,
session_entry->tspecIes,
sme_join_rsp->tspecIeLen);
cdf_mem_free(session_entry->tspecIes);
session_entry->tspecIes = NULL;
+ session_entry->tspecLen = 0;
lim_log(mac_ctx, LOG1, FL("ESE-TspecLen=%d"),
- session_entry->tspecLen);
+ sme_join_rsp->tspecIeLen);
}
#endif
sme_join_rsp->aid = session_entry->limAID;
#ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
lim_log(mac_ctx, LOG1, FL("AssocRsp=%d"),
- session_entry->assocRspLen);
+ sme_join_rsp->assocRspLength);
#endif
sme_join_rsp->vht_channel_width =
session_entry->ch_width;
@@ -367,25 +373,30 @@
if (session_entry->beacon != NULL) {
cdf_mem_free(session_entry->beacon);
session_entry->beacon = NULL;
+ session_entry->bcnLen = 0;
}
if (session_entry->assocReq != NULL) {
cdf_mem_free(session_entry->assocReq);
session_entry->assocReq = NULL;
+ session_entry->assocReqLen = 0;
}
if (session_entry->assocRsp != NULL) {
cdf_mem_free(session_entry->assocRsp);
session_entry->assocRsp = NULL;
+ session_entry->assocRspLen = 0;
}
#ifdef WLAN_FEATURE_VOWIFI_11R
if (session_entry->ricData != NULL) {
cdf_mem_free(session_entry->ricData);
session_entry->ricData = NULL;
+ session_entry->RICDataLen = 0;
}
#endif
#ifdef FEATURE_WLAN_ESE
if (session_entry->tspecIes != NULL) {
cdf_mem_free(session_entry->tspecIes);
session_entry->tspecIes = NULL;
+ session_entry->tspecLen = 0;
}
#endif
}
diff --git a/core/mac/src/pe/lim/lim_session.c b/core/mac/src/pe/lim/lim_session.c
index 5e7f1cf..2c245e9 100644
--- a/core/mac/src/pe/lim/lim_session.c
+++ b/core/mac/src/pe/lim/lim_session.c
@@ -601,16 +601,19 @@
if (session->beacon != NULL) {
cdf_mem_free(session->beacon);
session->beacon = NULL;
+ session->bcnLen = 0;
}
if (session->assocReq != NULL) {
cdf_mem_free(session->assocReq);
session->assocReq = NULL;
+ session->assocReqLen = 0;
}
if (session->assocRsp != NULL) {
cdf_mem_free(session->assocRsp);
session->assocRsp = NULL;
+ session->assocRspLen = 0;
}
if (session->parsedAssocReq != NULL) {