A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-31 12:10:52 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Avoid extscan bucket spec overread

Browse source 
Currently in hdd_extscan_start_fill_bucket_channel_spec() the
QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC attribute is parsed without
specifying a policy. This means that no policy is enforced.
Subsequently the values of the nested attributes are retrieved, but
again without any length limits enforced. This could result in a
buffer overread.

To prevent this issue:
* Parse using the existing policy wlan_hdd_extscan_config_policy
* Update the policy to add missing attributes

Change-Id: I3b20cb28d1beccd2e804b022b531413ad1edb533
CRs-Fixed: 2054958
This commit is contained in:
Jeff Johnson 2017-06-01 11:03:19 -07:00 • committed by snandini
commit 20b5dc36e3
1 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
core/hdd/src/wlan_hdd_ext_scan.c
View file

@ -110,6 +110,12 @@ static const struct nla_policy wlan_hdd_extscan_config_policy
.type = NLA_U32},
[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_NUM_AP] = {
.type = NLA_U32},
[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_MAX_PERIOD] = {
.type = NLA_U32},
[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_BASE] = {
.type = NLA_U32},
[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_STEP_COUNT] = {
.type = NLA_U32},
[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_SSID] = {
.type = NLA_BINARY,
.len = IEEE80211_MAX_SSID_LEN + 1 },
@ -2661,8 +2667,9 @@ static int hdd_extscan_start_fill_bucket_channel_spec(
}
if (nla_parse(bucket,
QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX,
nla_data(buckets), nla_len(buckets), NULL)) {
QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX,
nla_data(buckets), nla_len(buckets),
wlan_hdd_extscan_config_policy)) {
hdd_err("nla_parse failed");
return -EINVAL;
}