A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 07:37:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Resolve overflow while processing setHostOffload ioctl

Browse source 
qcacld-2.0 to qcacld-3.0 propagation

While processing setHostOffload ioctl there is a possibility of
sending invalid data to lower layers as user sent data structure
is different from local buffer structure.
To mitigate this issue, initialize local buffer to zero and then
update local buffer member by member.

Change-Id: I657d2a8c7d37435b1ad28ef6de60ea80a235ead9
CRs-Fixed: 2152143
This commit is contained in:
Hanumanth Reddy Pothula 2017-12-01 13:49:40 +05:30 • committed by snandini
commit 8fcade5661
1 changed files with 8 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

15
core/hdd/src/wlan_hdd_wext.c
View file

@ -9415,13 +9415,14 @@ static int __iw_set_host_offload(struct net_device *dev,
}
}
/* Execute offload request. The reason that we can copy the
* request information from the ioctl structure to the SME
* structure is that they are laid out exactly the same.
* Otherwise, each piece of information would have to be
* copied individually.
*/
memcpy(&offloadRequest, pRequest, wrqu->data.length);
qdf_mem_zero(&offloadRequest, sizeof(offloadRequest));
offloadRequest.offloadType = pRequest->offloadType;
offloadRequest.enableOrDisable = pRequest->enableOrDisable;
qdf_mem_copy(&offloadRequest.params, &pRequest->params,
sizeof(pRequest->params));
qdf_mem_copy(&offloadRequest.bssid, &pRequest->bssId.bytes,
QDF_MAC_ADDR_SIZE);
if (QDF_STATUS_SUCCESS !=
sme_set_host_offload(WLAN_HDD_GET_HAL_CTX(adapter),
adapter->session_id, &offloadRequest)) {