From 0b071179d427952004fde146ce09edd4af78ef6a Mon Sep 17 00:00:00 2001 From: Rajeev Kumar Date: Thu, 8 Feb 2018 18:21:57 -0800 Subject: [PATCH] qcacld-3.0: Add vdev id sanity check in wma stats event handlers Stats events are sent by WLAN FW based on over the air frame reception and may contain incorrect vdev id hence sanitize vdev id received from FW in stats events before accessing interface array based on it. Change-Id: I4ecc73fc27285c98c0ea8cebc27955213cd68399 CRs-Fixed: 2186953 --- core/wma/src/wma_utils.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c index beb41e895122..bb36214c1592 100644 --- a/core/wma/src/wma_utils.c +++ b/core/wma/src/wma_utils.c @@ -2456,6 +2456,12 @@ static void wma_vdev_stats_lost_link_helper(tp_wma_handle wma, static const uint8_t zero_mac[QDF_MAC_ADDR_SIZE] = {0}; int32_t bcn_snr, dat_snr; + if (vdev_stats->vdev_id >= wma->max_bssid) { + WMA_LOGE("%s: Invalid vdev_id %hu", + __func__, vdev_stats->vdev_id); + return; + } + node = &wma->interfaces[vdev_stats->vdev_id]; if (wma_is_vdev_up(vdev_stats->vdev_id) && !qdf_mem_cmp(node->bssid, zero_mac, QDF_MAC_ADDR_SIZE)) { @@ -2505,6 +2511,12 @@ static void wma_update_vdev_stats(tp_wma_handle wma, struct scheduler_msg sme_msg = { 0 }; int32_t bcn_snr, dat_snr; + if (vdev_stats->vdev_id >= wma->max_bssid) { + WMA_LOGE("%s: Invalid vdev_id %hu", + __func__, vdev_stats->vdev_id); + return; + } + bcn_snr = vdev_stats->vdev_snr.bcn_snr; dat_snr = vdev_stats->vdev_snr.dat_snr; WMA_LOGD("vdev id %d beancon snr %d data snr %d", @@ -2776,6 +2788,12 @@ static void wma_update_rssi_stats(tp_wma_handle wma, uint32_t temp_mask; uint8_t vdev_id; + if (rssi_stats->vdev_id >= wma->max_bssid) { + WMA_LOGE("%s: Invalid vdev_id %hu", + __func__, rssi_stats->vdev_id); + return; + } + vdev_id = rssi_stats->vdev_id; node = &wma->interfaces[vdev_id]; stats_rsp_params = (tAniGetPEStatsRsp *) node->stats_rsp;