From 19a5a7ef6774d2530e676d5baee0715c8de53802 Mon Sep 17 00:00:00 2001 From: Jeff Johnson Date: Thu, 15 Jun 2017 14:51:26 -0700 Subject: [PATCH] qcacld-3.0: Avoid overread when configuring MAC addresses Currently there are multiple cfg80211 vendor commands where MAC address attributes are defined in a nla_policy table with a type of NLA_UNSPEC but without a minimum length. Add the proper minimum length to avoid buffer overread. Change-Id: I11ff2bd813dc4e6784a7cdee66a0c10ca0e69fcf CRs-Fixed: 2062140 --- core/hdd/src/wlan_hdd_cfg80211.c | 4 +++- core/hdd/src/wlan_hdd_ext_scan.c | 3 ++- core/hdd/src/wlan_hdd_tdls.c | 16 ++++++++++++---- 3 files changed, 17 insertions(+), 6 deletions(-) diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c index aa2597b4420f..b20c87f623d9 100644 --- a/core/hdd/src/wlan_hdd_cfg80211.c +++ b/core/hdd/src/wlan_hdd_cfg80211.c @@ -4829,7 +4829,9 @@ wlan_hdd_wifi_config_policy[QCA_WLAN_VENDOR_ATTR_CONFIG_MAX + 1] = { [RX_REORDER_TIMEOUT_VIDEO] = {.type = NLA_U32}, [RX_REORDER_TIMEOUT_BESTEFFORT] = {.type = NLA_U32}, [RX_REORDER_TIMEOUT_BACKGROUND] = {.type = NLA_U32}, - [RX_BLOCKSIZE_PEER_MAC] = {.type = NLA_UNSPEC}, + [RX_BLOCKSIZE_PEER_MAC] = { + .type = NLA_UNSPEC, + .len = QDF_MAC_ADDR_SIZE}, [RX_BLOCKSIZE_WINLIMIT] = {.type = NLA_U32}, }; diff --git a/core/hdd/src/wlan_hdd_ext_scan.c b/core/hdd/src/wlan_hdd_ext_scan.c index 5a48fd92d73c..e4b18e5d16a3 100644 --- a/core/hdd/src/wlan_hdd_ext_scan.c +++ b/core/hdd/src/wlan_hdd_ext_scan.c @@ -93,7 +93,8 @@ static const struct nla_policy wlan_hdd_extscan_config_policy [QCA_WLAN_VENDOR_ATTR_EXTSCAN_GET_CACHED_SCAN_RESULTS_CONFIG_PARAM_MAX] = { .type = NLA_U32}, [QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_BSSID] = { - .type = NLA_UNSPEC}, + .type = NLA_UNSPEC, + .len = QDF_MAC_ADDR_SIZE}, [QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_RSSI_LOW] = { .type = NLA_S32}, [QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_RSSI_HIGH] = { diff --git a/core/hdd/src/wlan_hdd_tdls.c b/core/hdd/src/wlan_hdd_tdls.c index 700b40082f1a..7548ef40a0e4 100644 --- a/core/hdd/src/wlan_hdd_tdls.c +++ b/core/hdd/src/wlan_hdd_tdls.c @@ -3253,7 +3253,9 @@ int wlan_hdd_tdls_get_status(hdd_adapter_t *pAdapter, static const struct nla_policy wlan_hdd_tdls_config_enable_policy[QCA_WLAN_VENDOR_ATTR_TDLS_ENABLE_MAX + 1] = { - [QCA_WLAN_VENDOR_ATTR_TDLS_ENABLE_MAC_ADDR] = {.type = NLA_UNSPEC}, + [QCA_WLAN_VENDOR_ATTR_TDLS_ENABLE_MAC_ADDR] = { + .type = NLA_UNSPEC, + .len = QDF_MAC_ADDR_SIZE}, [QCA_WLAN_VENDOR_ATTR_TDLS_ENABLE_CHANNEL] = {.type = NLA_U32}, [QCA_WLAN_VENDOR_ATTR_TDLS_ENABLE_GLOBAL_OPERATING_CLASS] = {.type = NLA_U32}, @@ -3264,12 +3266,16 @@ static const struct nla_policy static const struct nla_policy wlan_hdd_tdls_config_disable_policy[QCA_WLAN_VENDOR_ATTR_TDLS_DISABLE_MAX + 1] = { - [QCA_WLAN_VENDOR_ATTR_TDLS_DISABLE_MAC_ADDR] = {.type = NLA_UNSPEC}, + [QCA_WLAN_VENDOR_ATTR_TDLS_DISABLE_MAC_ADDR] = { + .type = NLA_UNSPEC, + .len = QDF_MAC_ADDR_SIZE}, }; static const struct nla_policy wlan_hdd_tdls_config_state_change_policy[QCA_WLAN_VENDOR_ATTR_TDLS_STATE_MAX + 1] = { - [QCA_WLAN_VENDOR_ATTR_TDLS_STATE_MAC_ADDR] = {.type = NLA_UNSPEC}, + [QCA_WLAN_VENDOR_ATTR_TDLS_STATE_MAC_ADDR] = { + .type = NLA_UNSPEC, + .len = QDF_MAC_ADDR_SIZE}, [QCA_WLAN_VENDOR_ATTR_TDLS_NEW_STATE] = {.type = NLA_U32}, [QCA_WLAN_VENDOR_ATTR_TDLS_STATE_REASON] = {.type = NLA_S32}, [QCA_WLAN_VENDOR_ATTR_TDLS_STATE_CHANNEL] = {.type = NLA_U32}, @@ -3279,7 +3285,9 @@ static const struct nla_policy static const struct nla_policy wlan_hdd_tdls_config_get_status_policy [QCA_WLAN_VENDOR_ATTR_TDLS_GET_STATUS_MAX + 1] = { - [QCA_WLAN_VENDOR_ATTR_TDLS_GET_STATUS_MAC_ADDR] = {.type = NLA_UNSPEC}, + [QCA_WLAN_VENDOR_ATTR_TDLS_GET_STATUS_MAC_ADDR] = { + .type = NLA_UNSPEC, + .len = QDF_MAC_ADDR_SIZE}, [QCA_WLAN_VENDOR_ATTR_TDLS_GET_STATUS_STATE] = {.type = NLA_U32}, [QCA_WLAN_VENDOR_ATTR_TDLS_GET_STATUS_REASON] = {.type = NLA_S32}, [QCA_WLAN_VENDOR_ATTR_TDLS_GET_STATUS_CHANNEL] = {.type = NLA_U32},