A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-23 21:19:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Validate stats_req_type type before use as index of req array

Browse source 
Validate type which is used as index of req array to avoid any
out of bond access issue.

Change-Id: I75d08054b94b7066f7bdc030cf9896469c923a65
CRs-Fixed: 2305555
This commit is contained in:
Arif Hussain 2018-08-31 15:55:49 -07:00 • committed by nshrivas
commit 89557a3838
1 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
umac/cp_stats/dispatcher/src/wlan_cp_stats_mc_ucfg_api.c
View file

@ -487,6 +487,11 @@ QDF_STATUS ucfg_mc_cp_stats_set_pending_req(struct wlan_objmgr_psoc *psoc,
return QDF_STATUS_E_NULL_VALUE;
}
if (type > TYPE_MAX) {
cp_stats_err("Invalid type index: %d", type);
return QDF_STATUS_E_INVAL;
}
wlan_cp_stats_psoc_obj_lock(psoc_cp_stats_priv);
psoc_mc_stats = psoc_cp_stats_priv->obj_stats;
psoc_mc_stats->pending.type_map |= (1 << type);
@ -508,6 +513,11 @@ QDF_STATUS ucfg_mc_cp_stats_reset_pending_req(struct wlan_objmgr_psoc *psoc,
return QDF_STATUS_E_NULL_VALUE;
}
if (type > TYPE_MAX) {
cp_stats_err("Invalid type index: %d", type);
return QDF_STATUS_E_INVAL;
}
wlan_cp_stats_psoc_obj_lock(psoc_cp_stats_priv);
psoc_mc_stats = psoc_cp_stats_priv->obj_stats;
psoc_mc_stats->pending.type_map &= ~(1 << type);
@ -531,6 +541,10 @@ QDF_STATUS ucfg_mc_cp_stats_get_pending_req(struct wlan_objmgr_psoc *psoc,
return QDF_STATUS_E_NULL_VALUE;
}
if (type > TYPE_MAX) {
cp_stats_err("Invalid type index: %d", type);
return QDF_STATUS_E_INVAL;
}
wlan_cp_stats_psoc_obj_lock(psoc_cp_stats_priv);
psoc_mc_stats = psoc_cp_stats_priv->obj_stats;
*info = psoc_mc_stats->pending.req[type];