From 07db59ed46c625fef8225ef0e1b6d2f95ca06993 Mon Sep 17 00:00:00 2001 From: Vignesh Viswanathan Date: Wed, 4 Oct 2017 18:24:08 +0530 Subject: [PATCH] qcacld-3.0: Add check for vdev_id in wma_unified_bcntx_status_event_handler Currently resp_event->vdev_id, recevied from the FW, is directly used to refer to wma->interfaces without validating if the vdev_id is valid. Add sanity check to make sure vdev_id is less than max_bssid before using it. Change-Id: I734ff795a3936719b08493f868384dbde72a80df CRs-Fixed: 2119394 --- core/wma/src/wma_mgmt.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c index 78425ef350fa..beb57a978fda 100644 --- a/core/wma/src/wma_mgmt.c +++ b/core/wma/src/wma_mgmt.c @@ -517,6 +517,12 @@ int wma_unified_bcntx_status_event_handler(void *handle, WMA_LOGD("%s", __func__); + if (resp_event->vdev_id >= wma->max_bssid) { + WMA_LOGE("%s: received invalid vdev_id %d", + __func__, resp_event->vdev_id); + return -EINVAL; + } + /* Check for valid handle to ensure session is not * deleted in any race */