From 89557a383809e4bbff992121d5bdf45bd249207b Mon Sep 17 00:00:00 2001 From: Arif Hussain Date: Fri, 31 Aug 2018 15:55:49 -0700 Subject: [PATCH] qcacmn: Validate stats_req_type type before use as index of req array Validate type which is used as index of req array to avoid any out of bond access issue. Change-Id: I75d08054b94b7066f7bdc030cf9896469c923a65 CRs-Fixed: 2305555 --- .../dispatcher/src/wlan_cp_stats_mc_ucfg_api.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/umac/cp_stats/dispatcher/src/wlan_cp_stats_mc_ucfg_api.c b/umac/cp_stats/dispatcher/src/wlan_cp_stats_mc_ucfg_api.c index 847193e7cfd2..bd6c89041f18 100644 --- a/umac/cp_stats/dispatcher/src/wlan_cp_stats_mc_ucfg_api.c +++ b/umac/cp_stats/dispatcher/src/wlan_cp_stats_mc_ucfg_api.c @@ -487,6 +487,11 @@ QDF_STATUS ucfg_mc_cp_stats_set_pending_req(struct wlan_objmgr_psoc *psoc, return QDF_STATUS_E_NULL_VALUE; } + if (type > TYPE_MAX) { + cp_stats_err("Invalid type index: %d", type); + return QDF_STATUS_E_INVAL; + } + wlan_cp_stats_psoc_obj_lock(psoc_cp_stats_priv); psoc_mc_stats = psoc_cp_stats_priv->obj_stats; psoc_mc_stats->pending.type_map |= (1 << type); @@ -508,6 +513,11 @@ QDF_STATUS ucfg_mc_cp_stats_reset_pending_req(struct wlan_objmgr_psoc *psoc, return QDF_STATUS_E_NULL_VALUE; } + if (type > TYPE_MAX) { + cp_stats_err("Invalid type index: %d", type); + return QDF_STATUS_E_INVAL; + } + wlan_cp_stats_psoc_obj_lock(psoc_cp_stats_priv); psoc_mc_stats = psoc_cp_stats_priv->obj_stats; psoc_mc_stats->pending.type_map &= ~(1 << type); @@ -531,6 +541,10 @@ QDF_STATUS ucfg_mc_cp_stats_get_pending_req(struct wlan_objmgr_psoc *psoc, return QDF_STATUS_E_NULL_VALUE; } + if (type > TYPE_MAX) { + cp_stats_err("Invalid type index: %d", type); + return QDF_STATUS_E_INVAL; + } wlan_cp_stats_psoc_obj_lock(psoc_cp_stats_priv); psoc_mc_stats = psoc_cp_stats_priv->obj_stats; *info = psoc_mc_stats->pending.req[type];