From 0dbdfb482d52b4c6a0368992b9a303a72ed69103 Mon Sep 17 00:00:00 2001 From: Sourav Mohapatra Date: Tue, 19 Mar 2019 14:31:20 +0530 Subject: [PATCH] qcacld-3.0: Specify policy for vendor attribute Currently, there are some attributes that dont have any NLA policy specified. The absence of policy results the attribute to default to NLA_UNSPEC. When handling this case in validate_nla() there is no minimum length guarantee, meaning that the attribute can have zero length. This will result in a one byte overread when calling nla_get_u8(). To avoid this potential security vulnerability, add policy entry for the attribute. Change-Id: I19e5a032ccb2083d5f204be6ff7ac2f53aebf130 CRs-Fixed: 2408072 --- core/hdd/src/wlan_hdd_cfg80211.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c index 239f03811db5..86d796cd142a 100644 --- a/core/hdd/src/wlan_hdd_cfg80211.c +++ b/core/hdd/src/wlan_hdd_cfg80211.c @@ -5245,6 +5245,9 @@ static const struct nla_policy wlan_hdd_wifi_config_policy[QCA_WLAN_VENDOR_ATTR_CONFIG_MAX + 1] = { [QCA_WLAN_VENDOR_ATTR_CONFIG_MODULATED_DTIM] = {.type = NLA_U32 }, + [QCA_WLAN_VENDOR_ATTR_CONFIG_IGNORE_ASSOC_DISALLOWED] = { + .type = NLA_U8 }, + [QCA_WLAN_VENDOR_ATTR_CONFIG_DISABLE_FILS] = {.type = NLA_U8 }, [QCA_WLAN_VENDOR_ATTR_CONFIG_STATS_AVG_FACTOR] = {.type = NLA_U16 }, [QCA_WLAN_VENDOR_ATTR_CONFIG_GUARD_TIME] = {.type = NLA_U32 }, [QCA_WLAN_VENDOR_ATTR_CONFIG_FINE_TIME_MEASUREMENT] = {.type = NLA_U32},