A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 23:24:22 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix out-of-bounds in tx_stats

Browse source 
The tx_stats array length num_entries can't be more than
param_buf->num_tx_stats from fw.
Otherwies out-of-bounds will happen when read wmi_tx_stats.

Change-Id: I7ab3c7cc7baef6d903ba6301622bd67efe52cebe
CRs-Fixed: 3104318
This commit is contained in:
chunquan 2022-01-07 15:43:31 +08:00 • committed by Madan Koyyalamudi
commit 7f077b4b73
1 changed files with 10 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

14
core/wma/src/wma_utils.c
View file

@ -1,6 +1,6 @@
/*
* Copyright (c) 2013-2021 The Linux Foundation. All rights reserved.
* Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
* Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
*
* Permission to use, copy, modify, and/or distribute this software for
* any purpose with or without fee is hereby granted, provided that the
@ -1150,9 +1150,9 @@ wma_fill_tx_stats(struct sir_wifi_ll_ext_stats *ll_stats,
struct sir_wifi_tx *tx_stats;
struct sir_wifi_ll_ext_peer_stats *peer_stats;
uint32_t *tx_mpdu_aggr, *tx_succ_mcs, *tx_fail_mcs, *tx_delay;
uint32_t len, dst_len, param_len, tx_mpdu_aggr_array_len,
tx_succ_mcs_array_len, tx_fail_mcs_array_len,
tx_delay_array_len;
uint32_t len, dst_len, param_len, num_entries,
tx_mpdu_aggr_array_len, tx_succ_mcs_array_len,
tx_fail_mcs_array_len, tx_delay_array_len;
result = *buf;
dst_len = *buf_length;
@ -1231,6 +1231,12 @@ wma_fill_tx_stats(struct sir_wifi_ll_ext_stats *ll_stats,
return QDF_STATUS_E_FAILURE;
}
num_entries = fix_param->num_peer_ac_tx_stats * WLAN_MAX_AC;
if (num_entries > param_buf->num_tx_stats) {
wma_err("tx stats invalid arg, %d", num_entries);
return QDF_STATUS_E_FAILURE;
}
for (i = 0; i < fix_param->num_peer_ac_tx_stats; i++) {
uint32_t peer_id = wmi_peer_tx[i].peer_id;
struct sir_wifi_tx *ac;