From 902680eec5fda70bd5710279cc17346537caf5bd Mon Sep 17 00:00:00 2001 From: Rajeev Kumar Sirasanagandla Date: Tue, 9 Jul 2019 15:55:28 +0530 Subject: [PATCH] qcacld-3.0: Fix invalid check in softap API Some of softap APIs like hdd_softap_register_sta() contain sta_id validation check against maximum value of HDD_MAX_ADAPTERS before accessing adapter->sta_info[sta_id]. Since the maximum size of adapter->sta_info[] is WLAN_MAX_STA_COUNT and less than HDD_MAX_ADAPTERS (used in sta_id index validation) array out of bounds access is possible. To fix this, validate sta_id index against maximum value of WLAN_MAX_STA_COUNT instead of HDD_MAX_ADAPTERS. Change-Id: I18390a76a3bee852a9d6ca3dde4382fa94387594 CRs-Fixed: 2486518 --- core/hdd/src/wlan_hdd_softap_tx_rx.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/core/hdd/src/wlan_hdd_softap_tx_rx.c b/core/hdd/src/wlan_hdd_softap_tx_rx.c index 8aa50fbd9ea8..286b53ecf423 100644 --- a/core/hdd/src/wlan_hdd_softap_tx_rx.c +++ b/core/hdd/src/wlan_hdd_softap_tx_rx.c @@ -977,7 +977,7 @@ QDF_STATUS hdd_softap_deregister_sta(struct hdd_adapter *adapter, hdd_ctx = WLAN_HDD_GET_CTX(adapter); - if (sta_id >= HDD_MAX_ADAPTERS) { + if (sta_id >= WLAN_MAX_STA_COUNT) { hdd_err("Error: Invalid sta_id: %u", sta_id); return QDF_STATUS_E_INVAL; } @@ -1035,7 +1035,7 @@ QDF_STATUS hdd_softap_register_sta(struct hdd_adapter *adapter, hdd_info("STA:%u, Auth:%u, Priv:%u, WMM:%u", sta_id, auth_required, privacy_required, wmm_enabled); - if (sta_id >= HDD_MAX_ADAPTERS) { + if (sta_id >= WLAN_MAX_STA_COUNT) { hdd_err("Error: Invalid sta_id: %u", sta_id); return qdf_status; } @@ -1156,7 +1156,7 @@ QDF_STATUS hdd_softap_register_bc_sta(struct hdd_adapter *adapter, ap_ctx = WLAN_HDD_GET_AP_CTX_PTR(adapter); sta_id = ap_ctx->broadcast_sta_id; - if (sta_id >= HDD_MAX_ADAPTERS) { + if (sta_id >= WLAN_MAX_STA_COUNT) { hdd_err("Error: Invalid sta_id: %u", sta_id); return qdf_status; }