From 1e6b9262adeae0f6fac78537759c34c0a0791b6c Mon Sep 17 00:00:00 2001
From: Archana Ramachandran <archanar@codeaurora.org>
Date: Fri, 30 Sep 2016 15:15:10 -0700
Subject: [PATCH] qcacld-3.0: Add range check for P2P NOA request parameters

Add range check for P2P NOA parameters such as duration and
interval to prevent integer overflow from binary operation.

Change-Id: Iffa57d592af7ac6af7f67d80b85a276aa8faee4e
CRs-Fixed: 1072839
---
 core/hdd/src/wlan_hdd_p2p.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/core/hdd/src/wlan_hdd_p2p.c b/core/hdd/src/wlan_hdd_p2p.c
index ea3df68c7a47..1700a9c247c9 100644
--- a/core/hdd/src/wlan_hdd_p2p.c
+++ b/core/hdd/src/wlan_hdd_p2p.c
@@ -55,6 +55,7 @@
 
 /* Ms to Time Unit Micro Sec */
 #define MS_TO_TU_MUS(x)   ((x) * 1024)
+#define MAX_MUS_VAL       (INT_MAX / 1024)
 
 static uint8_t *hdd_get_action_string(uint16_t MsgType)
 {
@@ -1741,6 +1742,11 @@ int hdd_set_p2p_noa(struct net_device *dev, uint8_t *command)
 			ret);
 		return -EINVAL;
 	}
+	if (count < 0 || interval < 0 || duration < 0 ||
+	    interval > MAX_MUS_VAL || duration > MAX_MUS_VAL) {
+		hdd_err("Invalid NOA parameters");
+		return -EINVAL;
+	}
 	hdd_info("P2P_SET GO NoA: count=%d interval=%d duration=%d",
 		count, interval, duration);
 	duration = MS_TO_TU_MUS(duration);