From 4bb899c357b93538dc9761569adbaa9db535011d Mon Sep 17 00:00:00 2001
From: Vignesh Viswanathan <viswanat@codeaurora.org>
Date: Mon, 19 Nov 2018 17:20:35 +0530
Subject: [PATCH] qcacld-3.0: Add check for vdev_id in wma_rcpi_event_handler

Currently event->vdev_id, recevied from the FW, is directly used
to refer to wma->interfaces without validating if the vdev_id is valid.

Add sanity check to make sure vdev_id is less than max_bssid before
using it.

Change-Id: I9fd97e430532c597a6c4b4e42b5dfaddba628ffb
CRs-Fixed: 2119442
---
 core/wma/src/wma_utils.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c
index 09c266793d8a..871c4ac4fee9 100644
--- a/core/wma/src/wma_utils.c
+++ b/core/wma/src/wma_utils.c
@@ -4486,6 +4486,12 @@ int wma_rcpi_event_handler(void *handle, uint8_t *cmd_param_info,
 	if (status == QDF_STATUS_E_INVAL)
 		return -EINVAL;
 
+	if (res.vdev_id >= wma_handle->max_bssid) {
+		WMA_LOGE("%s: received invalid vdev_id %d",
+			 __func__, res.vdev_id);
+		return -EINVAL;
+	}
+
 	iface = &wma_handle->interfaces[res.vdev_id];
 	if (!iface->rcpi_req) {
 		WMI_LOGE("rcpi_req buffer not available");