android_kernel_xiaomi_sm8350/core
Vignesh Viswanathan 5f37b21cb6 qcacld-3.0: Check for minimum frame_len for action frames
In lim_process_action_frame and lim_process_action_frame_no_session,
The Rx frame pointer is directly casted to the action frame header
to find the Action frame category and action ID without validating
the minimum length of the frame. If the frame len is less than the
action frame header len, then OOB read would occur.

Check if frame_len is less than the size of action frame header len
and return if true.

Change-ID: Idf8ca7eeacdf57171d2850fe6317784911830aac
CRs-Fixed: 2253243
2018-06-14 02:56:29 -07:00
..
bmi qcacld-3.0: bmi: Fix misspellings 2018-05-16 18:01:27 -07:00
cds qcacld-3.0: Fix uninitialized variable in cds_is_gmac_mmie_valid 2018-06-14 02:56:13 -07:00
dp qcacld-3.0: Use of %p in htt_t2h_tx_ppdu_log_print() 2018-06-11 04:45:08 -07:00
hdd qcacld-3.0: Avoid buffer over-read in vendor scan 2018-06-14 02:56:10 -07:00
mac qcacld-3.0: Check for minimum frame_len for action frames 2018-06-14 02:56:29 -07:00
pld qcacld-3.0: Check if sdio device is valid before start wifi 2018-06-07 21:08:36 -07:00
sap qcacld-3.0: Free channel-list memory from Sap_context 2018-06-13 22:26:54 -07:00
sme qcacld-3.0: Add diag events for debugging 2018-06-14 02:56:07 -07:00
wma qcacld-3.0: Send CSA/ECSA Switch count offset in Beacon Template to FW 2018-06-14 02:56:24 -07:00