From 1ebed1b2f0c7de4f56d46742e6931903556e4afe Mon Sep 17 00:00:00 2001 From: Jingxiang Ge Date: Thu, 2 Dec 2021 11:12:22 +0800 Subject: [PATCH] qcacld-3.0: Check input parameters for tx_attr/rx_attr In hdd_config_tx_rx_nss and hdd_config_vdev_chains, it missed to check if tx_attr or rx_attr is null, which will cause invalid memory access. Change-Id: Ic3427d714e240507cf4253588f706d06d355ba93 CRs-Fixed: 3086252 --- core/hdd/src/wlan_hdd_cfg80211.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c index 1b9acfd88e35..69620c016b4c 100644 --- a/core/hdd/src/wlan_hdd_cfg80211.c +++ b/core/hdd/src/wlan_hdd_cfg80211.c @@ -7864,6 +7864,13 @@ static int hdd_config_vdev_chains(struct hdd_adapter *adapter, if (!tx_attr && !rx_attr) return 0; + /* if one is present, both must be present */ + if (!tx_attr || !rx_attr) { + hdd_err("Missing attribute for %s", + tx_attr ? "RX" : "TX"); + return -EINVAL; + } + tx_chains = nla_get_u8(tx_attr); rx_chains = nla_get_u8(rx_attr); @@ -7887,6 +7894,13 @@ static int hdd_config_tx_rx_nss(struct hdd_adapter *adapter, if (!tx_attr && !rx_attr) return 0; + /* if one is present, both must be present */ + if (!tx_attr || !rx_attr) { + hdd_err("Missing attribute for %s", + tx_attr ? "RX" : "TX"); + return -EINVAL; + } + tx_nss = nla_get_u8(tx_attr); rx_nss = nla_get_u8(rx_attr); hdd_debug("tx_nss %d rx_nss %d", tx_nss, rx_nss);