A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 22:40:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Avoid potential OOB read in wma_is_vdev_valid function

Browse source 
In function wma_is_vdev_valid, vdev_id received as argument is used
to access wma_handle->interfaces array directly without validation
of max value of vdev_id. If vdev_id is not less than max_bssid, then
an OOB read would occur in this function.

Also add free and break in wma_mc_process_msg while handling
SIR_HAL_CONFIG_GUARD_TIME message in WMA.

Change-Id: I5f4481c937d5c370b334f2a7f8a172d08140ab1d
CRs-Fixed: 2154304
This commit is contained in:
Vignesh Viswanathan 2017-12-12 14:45:38 +05:30 • committed by snandini
commit 9fa8fef7b7
2 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
core/wma/src/wma_dev_if.c
View file

@ -1164,6 +1164,13 @@ bool wma_is_vdev_valid(uint32_t vdev_id)
return false;
}
/* No of interface are allocated based on max_bssid value */
if (vdev_id >= wma_handle->max_bssid) {
WMA_LOGD("%s: vdev_id: %d is invalid, max_bssid: %d",
__func__, vdev_id, wma_handle->max_bssid);
return false;
}
WMA_LOGD("%s: vdev_id: %d, vdev_active: %d, is_vdev_valid %d",
__func__, vdev_id, wma_handle->interfaces[vdev_id].vdev_active,
wma_handle->interfaces[vdev_id].is_vdev_valid);

2
core/wma/src/wma_main.c
View file

@ -7820,6 +7820,8 @@ static QDF_STATUS wma_mc_process_msg(struct scheduler_msg *msg)
wma_config_guard_time(wma_handle,
(struct sir_guard_time_request *)
msg->bodyptr);
qdf_mem_free(msg->bodyptr);
break;
case WMA_IPA_OFFLOAD_ENABLE_DISABLE:
wma_ipa_offload_enable_disable(wma_handle,
(struct sir_ipa_offload_enable_disable *)msg->bodyptr);