From 4a28f4483dbca9f2b419b5364984d94a5ec9b6f7 Mon Sep 17 00:00:00 2001 From: Vivek Date: Wed, 27 May 2020 13:09:58 +0530 Subject: [PATCH] qcacmn: Add sanity check for qdf_nbuf_put_tail In DP while handling ppdu stats, we call qdf_nbuf_put_tail and proceed with updating the nbuf data whithout a check on the return status of qdf_nbuf_put_tail. If the qdf_nbuf_put_tail API failed, would free the nbuf and subsequent updates to the nbuf would result in use after free, which is resulting in memory corruption. Add check to verify the return status of qdf_nbuf_put_tail and proceed accordingly. Also while updating the ppdu stats, ensure the num of users of ppdu is checked against the max number of users defined. CRs-Fixed: 2678258 Change-Id: I00b661fdb342d31563506f93abd63673af8ede55 --- dp/wifi3.0/dp_rx_mon_status.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/dp/wifi3.0/dp_rx_mon_status.c b/dp/wifi3.0/dp_rx_mon_status.c index 594519a96446..1f936882f56a 100644 --- a/dp/wifi3.0/dp_rx_mon_status.c +++ b/dp/wifi3.0/dp_rx_mon_status.c @@ -526,7 +526,7 @@ static void dp_rx_stats_update(struct dp_pdev *pdev, preamble = ppdu->u.preamble; ppdu_type = ppdu->u.ppdu_type; - for (i = 0; i < ppdu->num_users; i++) { + for (i = 0; i < ppdu->num_users && i < CDP_MU_MAX_USERS; i++) { peer = NULL; ppdu_user = &ppdu->user[i]; if (ppdu_user->peer_id != HTT_INVALID_PEER) @@ -1406,8 +1406,10 @@ dp_rx_handle_ppdu_stats(struct dp_soc *soc, struct dp_pdev *pdev, dp_rx_mon_populate_cfr_info(pdev, ppdu_info, cdp_rx_ppdu); dp_rx_populate_cdp_indication_ppdu(pdev, ppdu_info, cdp_rx_ppdu); - qdf_nbuf_put_tail(ppdu_nbuf, - sizeof(struct cdp_rx_indication_ppdu)); + if (!qdf_nbuf_put_tail(ppdu_nbuf, + sizeof(struct cdp_rx_indication_ppdu))) + return; + dp_rx_stats_update(pdev, cdp_rx_ppdu); if (cdp_rx_ppdu->peer_id != HTT_INVALID_PEER) {