From ad2b2af2749fb25011e22e37b8daf1e5f594d7a1 Mon Sep 17 00:00:00 2001 From: Bala Venkatesh Date: Wed, 5 Dec 2018 14:36:28 +0530 Subject: [PATCH] qcacmn: Trim operation classes to max supported in tdls_extract_params Operation classes supported can be controlled by user, which can be sent greater than the max supported operations. This results in stack overflow in change station command for TDLS sta. Add check to validate operations supported param given by user and if it exceeds max supported value, set it to max supported value. Change-Id: Idd3a35e38b091546a17d7ec6329f19429e5c289c CRs-Fixed: 2361464 --- os_if/linux/tdls/src/wlan_cfg80211_tdls.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/os_if/linux/tdls/src/wlan_cfg80211_tdls.c b/os_if/linux/tdls/src/wlan_cfg80211_tdls.c index 6a04713f4de5..90f78c6d80c6 100644 --- a/os_if/linux/tdls/src/wlan_cfg80211_tdls.c +++ b/os_if/linux/tdls/src/wlan_cfg80211_tdls.c @@ -334,6 +334,13 @@ wlan_cfg80211_tdls_extract_params(struct tdls_update_peer_params *req_info, if (params->supported_channels_len) tdls_calc_channels_from_staparams(req_info, params); + if (params->supported_oper_classes_len > WLAN_MAX_SUPP_OPER_CLASSES) { + cfg80211_debug("received oper classes:%d, resetting it to max supported: %d", + params->supported_oper_classes_len, + WLAN_MAX_SUPP_OPER_CLASSES); + params->supported_oper_classes_len = WLAN_MAX_SUPP_OPER_CLASSES; + } + qdf_mem_copy(req_info->supported_oper_classes, params->supported_oper_classes, params->supported_oper_classes_len);