A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-11-10 12:52:37 -05:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix out of bound read issue in get link properties

Browse source 
Propagatin from qcacld-2.0 to qcacld-3.0

Length of the MAC address is not checked which may cause out of bound
read issue.

To resolve this add a check for MAC address length.

CRs-Fixed: 2063980
Change-Id: I58454b84c28b157cef35984d612a9bc6fdd9ec56
This commit is contained in:
Ashish Kumar Dhanotiya 2017-06-21 12:30:32 +05:30 • committed by snandini
commit 81e2acc6c8
1 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
core/hdd/src/wlan_hdd_cfg80211.c
View file

@ -6780,7 +6780,8 @@ static int wlan_hdd_cfg80211_set_probable_oper_channel(struct wiphy *wiphy,
static const struct
nla_policy
qca_wlan_vendor_attr_policy[QCA_WLAN_VENDOR_ATTR_MAX+1] = {
[QCA_WLAN_VENDOR_ATTR_MAC_ADDR] = { .type = NLA_UNSPEC },
[QCA_WLAN_VENDOR_ATTR_MAC_ADDR] = {
.type = NLA_BINARY, .len = QDF_MAC_ADDR_SIZE },
};
/**
@ -6835,6 +6836,12 @@ static int __wlan_hdd_cfg80211_get_link_properties(struct wiphy *wiphy,
return -EINVAL;
}
if (nla_len(tb[QCA_WLAN_VENDOR_ATTR_MAC_ADDR]) < QDF_MAC_ADDR_SIZE) {
hdd_err("Attribute peerMac is invalid for mode=%d",
adapter->device_mode);
return -EINVAL;
}
qdf_mem_copy(peer_mac, nla_data(tb[QCA_WLAN_VENDOR_ATTR_MAC_ADDR]),
QDF_MAC_ADDR_SIZE);
hdd_debug("peerMac="MAC_ADDRESS_STR" for device_mode:%d",