From 9fa8fef7b7aea53c2b3f5c7f4259b4d314b8ad36 Mon Sep 17 00:00:00 2001 From: Vignesh Viswanathan Date: Tue, 12 Dec 2017 14:45:38 +0530 Subject: [PATCH] qcacld-3.0: Avoid potential OOB read in wma_is_vdev_valid function In function wma_is_vdev_valid, vdev_id received as argument is used to access wma_handle->interfaces array directly without validation of max value of vdev_id. If vdev_id is not less than max_bssid, then an OOB read would occur in this function. Also add free and break in wma_mc_process_msg while handling SIR_HAL_CONFIG_GUARD_TIME message in WMA. Change-Id: I5f4481c937d5c370b334f2a7f8a172d08140ab1d CRs-Fixed: 2154304 --- core/wma/src/wma_dev_if.c | 7 +++++++ core/wma/src/wma_main.c | 2 ++ 2 files changed, 9 insertions(+) diff --git a/core/wma/src/wma_dev_if.c b/core/wma/src/wma_dev_if.c index e55cf5dac23b..458b4c4473b8 100644 --- a/core/wma/src/wma_dev_if.c +++ b/core/wma/src/wma_dev_if.c @@ -1164,6 +1164,13 @@ bool wma_is_vdev_valid(uint32_t vdev_id) return false; } + /* No of interface are allocated based on max_bssid value */ + if (vdev_id >= wma_handle->max_bssid) { + WMA_LOGD("%s: vdev_id: %d is invalid, max_bssid: %d", + __func__, vdev_id, wma_handle->max_bssid); + return false; + } + WMA_LOGD("%s: vdev_id: %d, vdev_active: %d, is_vdev_valid %d", __func__, vdev_id, wma_handle->interfaces[vdev_id].vdev_active, wma_handle->interfaces[vdev_id].is_vdev_valid); diff --git a/core/wma/src/wma_main.c b/core/wma/src/wma_main.c index 3b0d2f2e3385..0997d7c449b4 100644 --- a/core/wma/src/wma_main.c +++ b/core/wma/src/wma_main.c @@ -7820,6 +7820,8 @@ static QDF_STATUS wma_mc_process_msg(struct scheduler_msg *msg) wma_config_guard_time(wma_handle, (struct sir_guard_time_request *) msg->bodyptr); + qdf_mem_free(msg->bodyptr); + break; case WMA_IPA_OFFLOAD_ENABLE_DISABLE: wma_ipa_offload_enable_disable(wma_handle, (struct sir_ipa_offload_enable_disable *)msg->bodyptr);