From 2be2792e2ed1fd404029176263d0c2fcac9cd3b7 Mon Sep 17 00:00:00 2001 From: Sravan Kumar Kairam Date: Wed, 9 May 2018 17:16:12 +0530 Subject: [PATCH] qcacld-3.0: Fix possible OOB issue in ol_tx_desc_update_group_credit Currently tx desc id is extracted from HTT message and it is used without check. This may cause possible OOB array read. To address this add check for valid tx desc id. Change-Id: I121fc4d550aa587f00ec315e3a20dfb136f4d7af CRs-Fixed: 2225461 --- core/dp/txrx/ol_tx_send.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/core/dp/txrx/ol_tx_send.c b/core/dp/txrx/ol_tx_send.c index feeafde28e8b..d6ffcab39a9f 100644 --- a/core/dp/txrx/ol_tx_send.c +++ b/core/dp/txrx/ol_tx_send.c @@ -833,6 +833,11 @@ void ol_tx_desc_update_group_credit(ol_txrx_pdev_handle pdev, uint16_t vdev_id_mask; struct ol_tx_desc_t *tx_desc; + if (tx_desc_id >= pdev->tx_desc.pool_size) { + qdf_print("%s: Invalid desc id", __func__); + return; + } + tx_desc = ol_tx_desc_find(pdev, tx_desc_id); for (i = 0; i < OL_TX_MAX_TXQ_GROUPS; i++) { vdev_id_mask =