A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 15:11:48 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix potential buffer overflow htt_t2h_msg_handler

Browse source 
Currently variable "tid" is from message, which is used
directly as array size which causes buffer over-write.

To address this issue add check for the array size.

Change-Id: I9fae424d19ce5e886d385071863cbfca9633dd84
CRs-Fixed: 2148184
This commit is contained in:
Alok Kumar 2018-01-11 11:16:53 +05:30 • committed by snandini
commit 4278b69a04
2 changed files with 24 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
core/dp/txrx/ol_rx_defrag.c
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
* Copyright (c) 2011-2018 The Linux Foundation. All rights reserved.
*
* Previously licensed under the ISC license by Qualcomm Atheros, Inc.
*
@ -630,6 +630,11 @@ void ol_rx_defrag_waitlist_flush(struct ol_txrx_pdev_t *pdev)
break;
tid = rx_reorder->tid;
if (tid >= OL_TXRX_NUM_EXT_TIDS) {
ol_txrx_err("%s: invalid tid, %u\n", __FUNCTION__, tid);
WARN_ON(1);
continue;
}
/* get index 0 of the rx_reorder array */
rx_reorder_base = rx_reorder - tid;
peer =

19
core/dp/txrx/ol_rx_reorder.c
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
* Copyright (c) 2011-2018 The Linux Foundation. All rights reserved.
*
* Previously licensed under the ISC license by Qualcomm Atheros, Inc.
*
@ -531,6 +531,12 @@ ol_rx_addba_handler(ol_txrx_pdev_handle pdev,
struct ol_txrx_peer_t *peer;
struct ol_rx_reorder_t *rx_reorder;
if (tid >= OL_TXRX_NUM_EXT_TIDS) {
ol_txrx_err("%s: invalid tid, %u\n", __FUNCTION__, tid);
WARN_ON(1);
return;
}
peer = ol_txrx_peer_find_by_id(pdev, peer_id);
if (peer == NULL)
return;
@ -567,6 +573,12 @@ ol_rx_delba_handler(ol_txrx_pdev_handle pdev, uint16_t peer_id, uint8_t tid)
struct ol_txrx_peer_t *peer;
struct ol_rx_reorder_t *rx_reorder;
if (tid >= OL_TXRX_NUM_EXT_TIDS) {
ol_txrx_err("%s: invalid tid, %u\n", __FUNCTION__, tid);
WARN_ON(1);
return;
}
peer = ol_txrx_peer_find_by_id(pdev, peer_id);
if (peer == NULL)
return;
@ -668,6 +680,11 @@ ol_rx_pn_ind_handler(ol_txrx_pdev_handle pdev,
uint16_t seq_num;
int i = 0;
if (tid >= OL_TXRX_NUM_EXT_TIDS) {
ol_txrx_err("%s: invalid tid, %u\n", __FUNCTION__, tid);
WARN_ON(1);
return;
}
peer = ol_txrx_peer_find_by_id(pdev, peer_id);
if (!peer) {