A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 15:11:48 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Add sanity check for qdf_nbuf_put_tail

Browse source 
In DP while handling ppdu stats, we call qdf_nbuf_put_tail
and proceed with updating the nbuf data whithout a check on
the return status of qdf_nbuf_put_tail.

If the qdf_nbuf_put_tail API failed, would free the nbuf
and subsequent updates to the nbuf would result in use
after free, which is resulting in memory corruption.

Add check to verify the return status of qdf_nbuf_put_tail
and proceed accordingly.

Also while updating the ppdu stats, ensure the num of users
of ppdu is checked against the max number of users defined.

CRs-Fixed: 2678258
Change-Id: I00b661fdb342d31563506f93abd63673af8ede55
This commit is contained in:
Vivek 2020-05-27 13:09:58 +05:30 • committed by nshrivas
commit 4a28f4483d
1 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
dp/wifi3.0/dp_rx_mon_status.c
View file

@ -526,7 +526,7 @@ static void dp_rx_stats_update(struct dp_pdev *pdev,
preamble = ppdu->u.preamble;
ppdu_type = ppdu->u.ppdu_type;
for (i = 0; i < ppdu->num_users; i++) {
for (i = 0; i < ppdu->num_users && i < CDP_MU_MAX_USERS; i++) {
peer = NULL;
ppdu_user = &ppdu->user[i];
if (ppdu_user->peer_id != HTT_INVALID_PEER)
@ -1406,8 +1406,10 @@ dp_rx_handle_ppdu_stats(struct dp_soc *soc, struct dp_pdev *pdev,
dp_rx_mon_populate_cfr_info(pdev, ppdu_info, cdp_rx_ppdu);
dp_rx_populate_cdp_indication_ppdu(pdev,
ppdu_info, cdp_rx_ppdu);
qdf_nbuf_put_tail(ppdu_nbuf,
sizeof(struct cdp_rx_indication_ppdu));
if (!qdf_nbuf_put_tail(ppdu_nbuf,
sizeof(struct cdp_rx_indication_ppdu)))
return;
dp_rx_stats_update(pdev, cdp_rx_ppdu);
if (cdp_rx_ppdu->peer_id != HTT_INVALID_PEER) {