A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 16:46:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Avoid info leak in spectral scan handler

Browse source 
In __spectral_scan_msg_handler(), payload section of input data is
type casted to driver internal structure spectral_scan_msg without
validating payload length which can lead to kernel info leak
if the payload length is less than size of spectral_scan_msg.

To fix this, avoid type-cast and return error if payload length is
less than size of spectral_scan_msg.

Change-Id: Ie7e74cc2cdcf8136582e81ffc3a088fd5a881dc9
CRs-Fixed: 2468493
This commit is contained in:
Rajeev Kumar Sirasanagandla 2019-06-17 14:50:10 +05:30 • committed by nshrivas
commit 00b95b1569
1 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
core/hdd/src/wlan_hdd_spectralscan.c
View file

@ -447,7 +447,7 @@ static void __spectral_scan_msg_handler(const void *data, int data_len,
void *ctx, int pid)
{
struct spectral_scan_msg *ss_msg = NULL;
struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MAX + 1];
struct nlattr *tb[CLD80211_ATTR_MAX + 1];
struct hdd_context *hdd_ctx;
int ret;
@ -456,6 +456,10 @@ static void __spectral_scan_msg_handler(const void *data, int data_len,
if (ret)
return;
/*
* audit note: it is ok to pass a NULL policy here since only
* one attribute is parsed and it is explicitly validated
*/
if (wlan_cfg80211_nla_parse(tb, CLD80211_ATTR_MAX, data,
data_len, NULL)) {
hdd_err("nla parse fails");
@ -466,6 +470,12 @@ static void __spectral_scan_msg_handler(const void *data, int data_len,
hdd_err("attr VENDOR_DATA fails");
return;
}
if (nla_len(tb[CLD80211_ATTR_DATA]) < sizeof(*ss_msg)) {
hdd_err_rl("Invalid length for ATTR_DATA");
return;
}
ss_msg = (struct spectral_scan_msg *)nla_data(tb[CLD80211_ATTR_DATA]);
if (!ss_msg) {