diff options
| author | Vignesh Viswanathan <viswanat@codeaurora.org> | 2017-09-06 17:06:49 +0530 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-09-15 15:41:35 -0700 |
| commit | 8615ab20c55ae6c0f070e5d67d61c2ab08d722a0 (patch) | |
| tree | 2eed4fc1728725dfd1a79b1bea9536b3dfda3ba4 | |
| parent | 7d51eb7b0af2ff9bdfe3fcf7055b0a99166932d2 (diff) | |
qcacmn: Fix copy overwrite for kek len in gtk offload
With change I239bf5d6c4455d39181e335dbf73bcade16aee8e, kek len
WMI_GTK_OFFLOAD_KEK_BYTES is increased to 64 to accommodate FILS kek
which are sent as extended TLV in GTK offload command.
However, in legacy TLV, the same variable WMI_GTK_OFFLOAD_KEK_BYTES
is used to copy the legacy kek of len 16 which leads to memory
overwrite during copy
Define Legacy kek_len of 16 and use legacy kek_len to copy the
kek during gtk offload to avoid copy overwrite.
Change-Id: I54001c50fe7b83f69117513e2fb3a6c5ce34bddd
CRs-Fixed: 2101668
| -rw-r--r-- | wmi/inc/wmi_unified_param.h | 9 | ||||
| -rw-r--r-- | wmi/src/wmi_unified_tlv.c | 3 |
2 files changed, 7 insertions, 5 deletions
diff --git a/wmi/inc/wmi_unified_param.h b/wmi/inc/wmi_unified_param.h index 7aded043db97..db1049286bef 100644 --- a/wmi/inc/wmi_unified_param.h +++ b/wmi/inc/wmi_unified_param.h @@ -3182,10 +3182,11 @@ struct periodic_tx_pattern { uint8_t ucPattern[WMI_PERIODIC_TX_PTRN_MAX_SIZE]; }; -#define WMI_GTK_OFFLOAD_KEK_BYTES 64 -#define WMI_GTK_OFFLOAD_KCK_BYTES 16 -#define WMI_GTK_OFFLOAD_ENABLE 0 -#define WMI_GTK_OFFLOAD_DISABLE 1 +#define WMI_GTK_OFFLOAD_KEK_BYTES_LEGACY 16 +#define WMI_GTK_OFFLOAD_KEK_BYTES 64 +#define WMI_GTK_OFFLOAD_KCK_BYTES 16 +#define WMI_GTK_OFFLOAD_ENABLE 0 +#define WMI_GTK_OFFLOAD_DISABLE 1 /** * struct gtk_offload_params - gtk offload parameters diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 2b85927f7aa1..59ed53adff90 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -8908,7 +8908,8 @@ QDF_STATUS send_gtk_offload_cmd_tlv(wmi_unified_t wmi_handle, uint8_t vdev_id, /* Copy the keys and replay counter */ qdf_mem_copy(cmd->KCK, params->aKCK, WMI_GTK_OFFLOAD_KCK_BYTES); - qdf_mem_copy(cmd->KEK, params->aKEK, WMI_GTK_OFFLOAD_KEK_BYTES); + qdf_mem_copy(cmd->KEK, params->aKEK, + WMI_GTK_OFFLOAD_KEK_BYTES_LEGACY); qdf_mem_copy(cmd->replay_counter, ¶ms->ullKeyReplayCounter, GTK_REPLAY_COUNTER_BYTES); } else { |