From 499e2ccc29b017bb9c49142dc21462ca32887ed5 Mon Sep 17 00:00:00 2001 From: Yu Wang Date: Mon, 10 Aug 2020 13:30:33 +0800 Subject: [PATCH] qcacld-3.0: fix code defects for RRM frame processing Directly dereferencing pointer beacon_xmit_ind before null-checking, which may result in null pointer issue. Meanwhile, measurement_idx should be checked to avoid out-of-bounds read. Fix is to check before dereferencing it. CRs-Fixed: 2751550 Change-Id: I5241b3b16fcd9a04da121fd938b27d4070ea4e06 --- core/mac/src/pe/rrm/rrm_api.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/core/mac/src/pe/rrm/rrm_api.c b/core/mac/src/pe/rrm/rrm_api.c index 9828cf9559b9..830663a79899 100644 --- a/core/mac/src/pe/rrm/rrm_api.c +++ b/core/mac/src/pe/rrm/rrm_api.c @@ -921,9 +921,7 @@ rrm_process_beacon_report_xmit(struct mac_context *mac_ctx, tSirMacRadioMeasureReport *report = NULL; tSirMacBeaconReport *beacon_report; struct bss_description *bss_desc; - tpRRMReq curr_req = - mac_ctx->rrm.rrmPEContext. - pCurrentReq[beacon_xmit_ind->measurement_idx]; + tpRRMReq curr_req; struct pe_session *session_entry; uint8_t session_id, counter; uint8_t i, j; @@ -941,6 +939,16 @@ rrm_process_beacon_report_xmit(struct mac_context *mac_ctx, return QDF_STATUS_E_FAILURE; } + if (beacon_xmit_ind->measurement_idx >= + QDF_ARRAY_SIZE(mac_ctx->rrm.rrmPEContext.pCurrentReq)) { + pe_err("Received measurement_idx is out of range: %u - %lu", + beacon_xmit_ind->measurement_idx, + QDF_ARRAY_SIZE(mac_ctx->rrm.rrmPEContext.pCurrentReq)); + return QDF_STATUS_E_FAILURE; + } + + curr_req = mac_ctx->rrm.rrmPEContext. + pCurrentReq[beacon_xmit_ind->measurement_idx]; if (!curr_req) { pe_err("Received report xmit while there is no request pending in PE"); status = QDF_STATUS_E_FAILURE;