From 83fb60c84356b460b3e137a848badb7ac41d869a Mon Sep 17 00:00:00 2001 From: Lin Bai Date: Tue, 16 Oct 2018 16:23:36 +0800 Subject: [PATCH] qcacmn: Avoid OOB access to ast_table when del_ast Change Ia75f88c03c4d0eba0edbebf8e8f40d41396543d5 initialized the ast_idx to 0xFFFF, and when deleting ast for self BSS of STA mode, this index will be used to access ast_table whose size is less than 0xFFFF, and OOB may occur. For AST of STA's self BSS, do not clear the related ast_table. Change-Id: I3ceffd216061950024a524b25f1d38c43e1ee0e4 CRs-Fixed: 2334039 --- dp/wifi3.0/dp_peer.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/dp/wifi3.0/dp_peer.c b/dp/wifi3.0/dp_peer.c index 58709d0c17c9..0a5605ccd7ce 100644 --- a/dp/wifi3.0/dp_peer.c +++ b/dp/wifi3.0/dp_peer.c @@ -670,7 +670,12 @@ void dp_peer_del_ast(struct dp_soc *soc, struct dp_ast_entry *ast_entry) if (ast_entry->next_hop) { dp_peer_ast_send_wds_del(soc, ast_entry); } else { - soc->ast_table[ast_entry->ast_idx] = NULL; + /* + * For TYPE_SELF (STA mode), no T2H_PEER_MAP message to map + * the peer, hence no need to clear ast_table here. + */ + if (ast_entry->type != CDP_TXRX_AST_TYPE_SELF) + soc->ast_table[ast_entry->ast_idx] = NULL; TAILQ_REMOVE(&peer->ast_entry_list, ast_entry, ase_list_elem); if (ast_entry == peer->self_ast_entry) @@ -702,7 +707,12 @@ void dp_peer_del_ast(struct dp_soc *soc, struct dp_ast_entry *ast_entry) soc->cdp_soc.ol_ops->peer_del_wds_entry(peer->vdev->osif_vdev, ast_entry->mac_addr.raw); - soc->ast_table[ast_entry->ast_idx] = NULL; + /* + * For TYPE_SELF (STA mode), no T2H_PEER_MAP message to map the peer, + * hence no need to clear ast_table here. + */ + if (ast_entry->type != CDP_TXRX_AST_TYPE_SELF) + soc->ast_table[ast_entry->ast_idx] = NULL; TAILQ_REMOVE(&peer->ast_entry_list, ast_entry, ase_list_elem); if (ast_entry == peer->self_ast_entry) @@ -1233,7 +1243,7 @@ dp_rx_peer_map_handler(void *soc_handle, uint16_t peer_id, if (peer) { /* - * For every peer MAp message search and set if bss_peer + * For every peer Map message search and set if bss_peer */ if (!(qdf_mem_cmp(peer->mac_addr.raw, peer->vdev->mac_addr.raw,