A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 08:36:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Add max index check for dscp_to_up_map array

Browse source 
In SME layer, boundary check for dscp_to_up_map array is not present.

The dscpmapping is an array of 0x40 elements. Values in dscp_exceptions
are used to index dscpmapping. The indices are not validated to be less
than 0x40. The dscp_exceptions array is received from association
response frame. A malicious AP can send values up to 0xff, causing OOB
write of dscpmapping array.

Hence, max index check is added to avoid OOB write of dscpmapping array.

Change-Id: I73526849677e867673fc0bd0024ed2b003e4f89e
CRs-Fixed: 2569764
This commit is contained in:
Abhishek Ambure 2019-12-05 20:27:55 +05:30 • committed by nshrivas
commit 3d18b4c831
5 changed files with 9 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

2
core/hdd/inc/wlan_hdd_main.h
View file

@ -1231,7 +1231,7 @@ struct hdd_adapter {
bool offloads_configured;
/* DSCP to UP QoS Mapping */
enum sme_qos_wmmuptype dscp_to_up_map[WLAN_HDD_MAX_DSCP + 1];
enum sme_qos_wmmuptype dscp_to_up_map[WLAN_MAX_DSCP + 1];
#ifdef WLAN_FEATURE_LINK_LAYER_STATS
bool is_link_layer_stats_set;

2
core/hdd/inc/wlan_hdd_wmm.h
View file

@ -194,8 +194,6 @@ extern const uint8_t hdd_qdisc_ac_to_tl_ac[];
extern const uint8_t hdd_wmm_up_to_ac_map[];
extern const uint8_t hdd_linux_up_to_ac_map[];
#define WLAN_HDD_MAX_DSCP 0x3f
/**
* hdd_wmmps_helper() - Function to set uapsd psb dynamically
*

4
core/hdd/src/wlan_hdd_wmm.c
View file

@ -56,8 +56,6 @@
#include "sme_api.h"
#include "wlan_mlme_ucfg_api.h"
#define WLAN_HDD_MAX_DSCP 0x3f
#define HDD_WMM_UP_TO_AC_MAP_SIZE 8
const uint8_t hdd_wmm_up_to_ac_map[] = {
@ -1478,7 +1476,7 @@ QDF_STATUS hdd_wmm_init(struct hdd_adapter *adapter)
/* DSCP to User Priority Lookup Table
* By default use the 3 Precedence bits of DSCP as the User Priority
*/
for (dscp = 0; dscp <= WLAN_HDD_MAX_DSCP; dscp++)
for (dscp = 0; dscp <= WLAN_MAX_DSCP; dscp++)
dscp_to_up_map[dscp] = dscp >> 3;
/* Special case for Expedited Forwarding (DSCP 46) */

4
core/sme/inc/sme_qos_api.h
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2014-2018 The Linux Foundation. All rights reserved.
* Copyright (c) 2014-2019 The Linux Foundation. All rights reserved.
*
* Permission to use, copy, modify, and/or distribute this software for
* any purpose with or without fee is hereby granted, provided that the
@ -133,6 +133,8 @@ enum sme_qos_statustype {
};
#define WLAN_MAX_DSCP 0x3f
/*
* Enumeration of the various User priority (UP) types
* From 802.1D/802.11e/WMM specifications (all refer to same table)

17
core/sme/src/common/sme_api.c
View file

@ -9703,24 +9703,15 @@ QDF_STATUS sme_update_dsc_pto_up_mapping(mac_handle_t mac_handle,
sme_release_global_lock(&mac->sme);
return QDF_STATUS_E_FAILURE;
}
for (i = 0; i < SME_QOS_WMM_UP_MAX; i++) {
for (j = pSession->QosMapSet.dscp_range[i][0];
j <= pSession->QosMapSet.dscp_range[i][1];
j++) {
if ((pSession->QosMapSet.dscp_range[i][0] == 255)
&& (pSession->QosMapSet.dscp_range[i][1] ==
255)) {
QDF_TRACE(QDF_MODULE_ID_SME,
QDF_TRACE_LEVEL_DEBUG,
FL("User Priority %d isn't used"), i);
break;
} else {
j <= pSession->QosMapSet.dscp_range[i][1] &&
j <= WLAN_MAX_DSCP; j++)
dscpmapping[j] = i;
}
}
}
for (i = 0; i < pSession->QosMapSet.num_dscp_exceptions; i++)
if (pSession->QosMapSet.dscp_exceptions[i][0] != 255)
if (pSession->QosMapSet.dscp_exceptions[i][0] <= WLAN_MAX_DSCP)
dscpmapping[pSession->QosMapSet.dscp_exceptions[i][0]] =
pSession->QosMapSet.dscp_exceptions[i][1];