A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-26 06:33:19 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Possible OOB read/write in cds_hang_event_notifier_call

Browse source 
Fix the possible OOB read/write in cds_hang_event_notifier_call.

Change-Id: I43e7012d14825c89f6e022e8ffe19e57d606fe79
CRs-Fixed: 2751718
This commit is contained in:
Min Liu 2020-08-10 16:14:15 +08:00 • committed by snandini
commit 10f8bfae30
1 changed files with 7 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

11
core/cds/src/cds_api.c
View file

@ -92,11 +92,14 @@ static struct __qdf_device g_qdf_ctx;
static uint8_t cds_multicast_logging;
#define DRIVER_VER_LEN (11)
#define HANG_EVENT_VER_LEN (1)
struct cds_hang_event_fixed_param {
uint16_t tlv_header;
uint8_t recovery_reason;
char driver_version[11];
char hang_event_version;
char driver_version[DRIVER_VER_LEN];
char hang_event_version[HANG_EVENT_VER_LEN];
} qdf_packed;
#ifdef QCA_WIFI_QCA8074
@ -577,10 +580,10 @@ static int cds_hang_event_notifier_call(struct notifier_block *block,
cmd->recovery_reason = gp_cds_context->recovery_reason;
qdf_mem_copy(&cmd->driver_version, QWLAN_VERSIONSTR,
sizeof(QWLAN_VERSIONSTR));
DRIVER_VER_LEN);
qdf_mem_copy(&cmd->hang_event_version, QDF_HANG_EVENT_VERSION,
sizeof(QDF_HANG_EVENT_VERSION));
HANG_EVENT_VER_LEN);
cds_hang_data->offset += total_len;
return NOTIFY_OK;