wlan-ap-Telecominfraproject/feeds/qca/hostapd/patches/q19-hostapd-fix-MBSSID-IE-len-calculation.patch

From 008ecaede12be6a6929bad28a170a99aae42ba04 Mon Sep 17 00:00:00 2001
From: Aditya Kumar Singh <quic_adisi@quicinc.com>
Date: Thu, 17 Aug 2023 10:54:36 +0530
Subject: [PATCH] hostapd: fix MBSSID IE len calculation

Currently while deciding to create a new MBSSID IE based on the condition
when length reaches 255, the length value being used is the total IE length
(including length of Element ID and Length field as well). However, the value
in the length field denotes the bytes following it and excluding it and hence
including the total length is wrong. This leads to incorrect MBSSID IE count.

And while filling the data, the length is considered porperly as it should be
hence we are filling more data in single go and all data is filled in MBSSID
count which was less than originally calculated. This ultimately leads to
incorrect access of data while putting this into NL socket buffer and setting
beacon fails.

Fix this issue by considering the length excluding the Element ID and Length
sizes.

Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
---
 src/ap/ieee802_11.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

--- a/src/ap/ieee802_11.c
+++ b/src/ap/ieee802_11.c
@@ -7774,7 +7774,17 @@ static size_t hostapd_eid_mbssid_elem_le
 					  size_t known_bss_len)
 {
 	struct hostapd_data *tx_bss = hostapd_mbssid_get_tx_bss(hapd);
-	size_t len = 3, i, tx_xrate_len;
+	size_t len, i, tx_xrate_len;
+
+	/* Element ID: 1 octet
+	 * Length: 1 octet
+	 * Max BSSID Indicator: 1 octet
+	 *
+	 * New MBSSID IE will be required when value in len reaches 255. Hence,
+	 * for now len will have 1 byte for Max BSSID Indicator. Before returing
+	 * len, we will add the 2 bytes for Element ID and Length.
+	 */
+	len = 1;
 
 	hostapd_eid_ext_supp_rates(tx_bss, NULL, &tx_xrate_len);
 	for (i = *bss_index; i < hapd->iface->num_bss; i++) {
@@ -7834,6 +7844,8 @@ static size_t hostapd_eid_mbssid_elem_le
 	}
 
 	*bss_index = i;
+	len += 2;
+
 	return len;
 }