A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 08:07:32 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix invalid check in softap API

Browse source 
Some of softap APIs like hdd_softap_register_sta() contain sta_id
validation check against maximum value of HDD_MAX_ADAPTERS before
accessing adapter->sta_info[sta_id].

Since the maximum size of adapter->sta_info[] is WLAN_MAX_STA_COUNT
and less than HDD_MAX_ADAPTERS (used in sta_id index validation)
array out of bounds access is possible.

To fix this, validate sta_id index against maximum value of
WLAN_MAX_STA_COUNT instead of HDD_MAX_ADAPTERS.

Change-Id: I18390a76a3bee852a9d6ca3dde4382fa94387594
CRs-Fixed: 2486518
This commit is contained in:
Rajeev Kumar Sirasanagandla 2019-07-09 15:55:28 +05:30 • committed by nshrivas
commit 902680eec5
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
core/hdd/src/wlan_hdd_softap_tx_rx.c
View file

@ -977,7 +977,7 @@ QDF_STATUS hdd_softap_deregister_sta(struct hdd_adapter *adapter,
hdd_ctx = WLAN_HDD_GET_CTX(adapter);
if (sta_id >= HDD_MAX_ADAPTERS) {
if (sta_id >= WLAN_MAX_STA_COUNT) {
hdd_err("Error: Invalid sta_id: %u", sta_id);
return QDF_STATUS_E_INVAL;
}
@ -1035,7 +1035,7 @@ QDF_STATUS hdd_softap_register_sta(struct hdd_adapter *adapter,
hdd_info("STA:%u, Auth:%u, Priv:%u, WMM:%u",
sta_id, auth_required, privacy_required, wmm_enabled);
if (sta_id >= HDD_MAX_ADAPTERS) {
if (sta_id >= WLAN_MAX_STA_COUNT) {
hdd_err("Error: Invalid sta_id: %u", sta_id);
return qdf_status;
}
@ -1156,7 +1156,7 @@ QDF_STATUS hdd_softap_register_bc_sta(struct hdd_adapter *adapter,
ap_ctx = WLAN_HDD_GET_AP_CTX_PTR(adapter);
sta_id = ap_ctx->broadcast_sta_id;
if (sta_id >= HDD_MAX_ADAPTERS) {
if (sta_id >= WLAN_MAX_STA_COUNT) {
hdd_err("Error: Invalid sta_id: %u", sta_id);
return qdf_status;
}