diff options
| -rw-r--r-- | core/hdd/src/wlan_hdd_ext_scan.c | 49 |
1 files changed, 31 insertions, 18 deletions
diff --git a/core/hdd/src/wlan_hdd_ext_scan.c b/core/hdd/src/wlan_hdd_ext_scan.c index 710c118ecdc4..defad2bc96c8 100644 --- a/core/hdd/src/wlan_hdd_ext_scan.c +++ b/core/hdd/src/wlan_hdd_ext_scan.c @@ -112,15 +112,6 @@ static const struct nla_policy wlan_hdd_extscan_config_policy .type = NLA_U32}, [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_NUM_AP] = { .type = NLA_U32}, - [QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_NUM_NETWORKS] = { - .type = NLA_U32 }, - [QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_SSID] = { - .type = NLA_BINARY, - .len = IEEE80211_MAX_SSID_LEN }, - [QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_FLAGS] = { - .type = NLA_U8 }, - [QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_AUTH_BIT] = { - .type = NLA_U8 }, [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_SSID] = { .type = NLA_BINARY, .len = IEEE80211_MAX_SSID_LEN + 1 }, @@ -139,6 +130,23 @@ static const struct nla_policy wlan_hdd_extscan_config_policy }; static const struct nla_policy +wlan_hdd_pno_config_policy[QCA_WLAN_VENDOR_ATTR_PNO_MAX + 1] = { + [QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_NUM_NETWORKS] = { + .type = NLA_U32 + }, + [QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_SSID] = { + .type = NLA_BINARY, + .len = IEEE80211_MAX_SSID_LEN + 1 + }, + [QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_FLAGS] = { + .type = NLA_U8 + }, + [QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_AUTH_BIT] = { + .type = NLA_U8 + }, +}; + +static const struct nla_policy wlan_hdd_extscan_results_policy[QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_MAX + 1] = { [QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_BEACON_PERIOD] = { .type = NLA_U16}, @@ -3758,19 +3766,18 @@ static int hdd_extscan_epno_fill_network_list( struct wifi_epno_params *req_msg, struct nlattr **tb) { - struct nlattr *network[ - QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX + 1]; + struct nlattr *network[QCA_WLAN_VENDOR_ATTR_PNO_MAX + 1]; struct nlattr *networks; int rem1, ssid_len; uint8_t index, *ssid; index = 0; nla_for_each_nested(networks, - tb[QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORKS_LIST], - rem1) { - if (nla_parse(network, - QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX, - nla_data(networks), nla_len(networks), NULL)) { + tb[QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORKS_LIST], + rem1) { + if (nla_parse(network, QCA_WLAN_VENDOR_ATTR_PNO_MAX, + nla_data(networks), nla_len(networks), + wlan_hdd_pno_config_policy)) { hdd_err("nla_parse failed"); return -EINVAL; } @@ -3783,6 +3790,12 @@ static int hdd_extscan_epno_fill_network_list( ssid_len = nla_len( network[QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_SSID]); + /* nla_parse will detect overflow but not underflow */ + if (0 == ssid_len) { + hdd_err("zero ssid length"); + return -EINVAL; + } + /* Decrement by 1, don't count null character */ ssid_len--; @@ -3862,8 +3875,8 @@ static int __wlan_hdd_cfg80211_set_epno_list(struct wiphy *wiphy, } if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_PNO_MAX, - data, data_len, - wlan_hdd_extscan_config_policy)) { + data, data_len, + wlan_hdd_pno_config_policy)) { hdd_err("Invalid ATTR"); return -EINVAL; } |