From 8d80aa857b4fb9a7ab12c163db4655d34db36eaa Mon Sep 17 00:00:00 2001 From: Abhishek Singh Date: Thu, 1 Nov 2018 09:56:26 +0530 Subject: [PATCH] qcacmn: Validate the scan requester id before un-registering index In ucfg_scan_unregister_requester even if caller provide an invalid requester id, the index is unregistered without checking if requester id is valid. Validate the scan requester id before un-registering the index. Change-Id: I0e946b8c1bdb87b7929745bcd646076d2b664c38 CRs-Fixed: 2343177 --- umac/scan/dispatcher/src/wlan_scan_ucfg_api.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/umac/scan/dispatcher/src/wlan_scan_ucfg_api.c b/umac/scan/dispatcher/src/wlan_scan_ucfg_api.c index 2bf3c1d0d7b4..eb2b8118403d 100644 --- a/umac/scan/dispatcher/src/wlan_scan_ucfg_api.c +++ b/umac/scan/dispatcher/src/wlan_scan_ucfg_api.c @@ -1231,12 +1231,19 @@ void ucfg_scan_unregister_requester(struct wlan_objmgr_psoc *psoc, wlan_scan_requester requester) { - int idx = requester & WLAN_SCAN_REQUESTER_ID_MASK; + int idx; struct wlan_scan_obj *scan; struct scan_requester_info *requesters; + idx = requester & WLAN_SCAN_REQUESTER_ID_PREFIX; + if (idx != WLAN_SCAN_REQUESTER_ID_PREFIX) { + scm_err("prefix didn't match for requester id %d", requester); + return; + } + + idx = requester & WLAN_SCAN_REQUESTER_ID_MASK; if (idx >= WLAN_MAX_REQUESTORS) { - scm_err("requester id invalid"); + scm_err("requester id %d greater than max value", requester); return; }