From 107a659f57566b7580b621779b01f7dca8e7199c Mon Sep 17 00:00:00 2001 From: Rakshith Suresh Patkar Date: Fri, 8 Feb 2019 16:17:27 +0530 Subject: [PATCH] qcacld-3.0: Validate session_id in __wlan_ipa_wlan_evt Session_id in __wlan_ipa_wlan_evt is used as an index to access the array ipa_ctx->vdev_to_iface[]. Add sanity check for session_id to avoid invalid access. Change-Id: Ie6079924c4772c3fa892b4537120db136a899885 CRs-Fixed: 2395162 --- components/ipa/core/src/wlan_ipa_core.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/components/ipa/core/src/wlan_ipa_core.c b/components/ipa/core/src/wlan_ipa_core.c index e9a3a49395a8..22cf649b3017 100644 --- a/components/ipa/core/src/wlan_ipa_core.c +++ b/components/ipa/core/src/wlan_ipa_core.c @@ -1497,6 +1497,9 @@ static QDF_STATUS __wlan_ipa_wlan_evt(qdf_netdev_t net_dev, uint8_t device_mode, int i; QDF_STATUS status; uint8_t sta_session_id = WLAN_IPA_MAX_SESSION; + struct wlan_objmgr_pdev *pdev; + struct wlan_objmgr_psoc *psoc; + struct wlan_objmgr_vdev *vdev; ipa_debug("%s: EVT: %d, MAC: %pM, sta_id: %d session_id: %u", net_dev->name, type, mac_addr, sta_id, session_id); @@ -1510,6 +1513,14 @@ static QDF_STATUS __wlan_ipa_wlan_evt(qdf_netdev_t net_dev, uint8_t device_mode, return QDF_STATUS_SUCCESS; } + pdev = ipa_ctx->pdev; + psoc = wlan_pdev_get_psoc(pdev); + vdev = wlan_objmgr_get_vdev_by_id_from_psoc(psoc, session_id, + WLAN_IPA_ID); + QDF_BUG((session_id < WLAN_IPA_MAX_SESSION) && vdev); + if (vdev) + wlan_objmgr_vdev_release_ref(vdev, WLAN_IPA_ID); + if (ipa_ctx->sta_connected) { iface_ctx = wlan_ipa_get_iface(ipa_ctx, QDF_STA_MODE); if (iface_ctx)