A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Validate vendor command set roaming params

Browse source 
Currently there is no nl policy defined for vendor sub command
QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_MAX which may result in
buffer overread error.

To resolve this, add nl policy.

Change-Id: Ib5d3c34dbcec29a98766753efc4e9c4ecf748c2e
CRs-Fixed: 2054693
This commit is contained in:
Ravi Kumar Bokka 2017-06-08 20:12:39 +05:30 • committed by snandini
commit 6cb9b3747b
1 changed files with 40 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

44
core/hdd/src/wlan_hdd_cfg80211.c
View file

@ -3061,6 +3061,42 @@ wlan_hdd_cfg80211_get_features(struct wiphy *wiphy,
#define PRAM_SSID_LIST QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_WHITE_LIST_SSID_LIST
#define PARAM_LIST_SSID QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_WHITE_LIST_SSID
#define MAX_ROAMING_PARAM \
QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_MAX
static const struct nla_policy
wlan_hdd_set_roam_param_policy[MAX_ROAMING_PARAM + 1] = {
[QCA_WLAN_VENDOR_ATTR_ROAMING_SUBCMD] = {.type = NLA_U32},
[QCA_WLAN_VENDOR_ATTR_ROAMING_REQ_ID] = {.type = NLA_U32},
[PARAM_NUM_NW] = {.type = NLA_U32},
[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_A_BAND_BOOST_FACTOR] = {
.type = NLA_U32},
[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_A_BAND_PENALTY_FACTOR] = {
.type = NLA_U32},
[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_A_BAND_MAX_BOOST] = {
.type = NLA_U32},
[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_LAZY_ROAM_HISTERESYS] = {
.type = NLA_S32},
[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_A_BAND_BOOST_THRESHOLD] = {
.type = NLA_S32},
[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_A_BAND_PENALTY_THRESHOLD] = {
.type = NLA_S32},
[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_ALERT_ROAM_RSSI_TRIGGER] = {
.type = NLA_U32},
[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_ENABLE] = {
.type = NLA_S32},
[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_NUM_BSSID] = {
.type = NLA_U32},
[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_RSSI_MODIFIER] = {
.type = NLA_U32},
[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS_NUM_BSSID] = {
.type = NLA_U32},
[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_BSSID] = {
.type = NLA_BINARY,
.len = QDF_MAC_ADDR_SIZE},
[PARAM_SET_BSSID] = {.type = NLA_BINARY, .len = QDF_MAC_ADDR_SIZE},
};
/**
* __wlan_hdd_cfg80211_set_ext_roam_params() - Settings for roaming parameters
* @wiphy: The wiphy structure
@ -3109,7 +3145,7 @@ __wlan_hdd_cfg80211_set_ext_roam_params(struct wiphy *wiphy,
if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_MAX,
data, data_len,
NULL)) {
wlan_hdd_set_roam_param_policy)) {
hdd_err("Invalid ATTR");
return -EINVAL;
}
@ -3147,7 +3183,7 @@ __wlan_hdd_cfg80211_set_ext_roam_params(struct wiphy *wiphy,
if (nla_parse(tb2,
QCA_WLAN_VENDOR_ATTR_ROAM_SUBCMD_MAX,
nla_data(curr_attr), nla_len(curr_attr),
NULL)) {
wlan_hdd_set_roam_param_policy)) {
hdd_err("nla_parse failed");
goto fail;
}
@ -3303,7 +3339,7 @@ __wlan_hdd_cfg80211_set_ext_roam_params(struct wiphy *wiphy,
if (nla_parse(tb2,
QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_MAX,
nla_data(curr_attr), nla_len(curr_attr),
NULL)) {
wlan_hdd_set_roam_param_policy)) {
hdd_err("nla_parse failed");
goto fail;
}
@ -3365,7 +3401,7 @@ __wlan_hdd_cfg80211_set_ext_roam_params(struct wiphy *wiphy,
if (nla_parse(tb2,
QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_MAX,
nla_data(curr_attr), nla_len(curr_attr),
NULL)) {
wlan_hdd_set_roam_param_policy)) {
hdd_err("nla_parse failed");
goto fail;
}