A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-08 21:22:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Check channel_count in DCC_GET_STATS command

Browse source 
Invalid channel_count may be sent to driver with
QCA_NL80211_VENDOR_SUBCMD_DCC_GET_STATS vendor command, and may also
pass the sanity check with get_stats_param->request_array_len as
integer overflow, in send_dcc_get_stats_cmd_tlv().
Then it will finally lead to heap overflow when initializing
TLV header for each channel.

Change-Id: I1d81b5fc4de80829433f2a0ab41c964c41f750c3
CRs-Fixed: 2300516
This commit is contained in:
Lin Bai 2018-09-11 22:53:28 +08:00 • committed by nshrivas
commit ad80a20204
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
core/hdd/src/wlan_hdd_ocb.c
View file

@ -1655,6 +1655,12 @@ static int __wlan_hdd_cfg80211_dcc_get_stats(struct wiphy *wiphy,
request_array = nla_data(
tb[QCA_WLAN_VENDOR_ATTR_DCC_GET_STATS_REQUEST_ARRAY]);
/* Check channel count. Per 11p spec, max 2 channels allowed */
if (!channel_count || channel_count > CFG_TGT_NUM_OCB_CHANNELS) {
hdd_err("Invalid channel_count %d", channel_count);
return -EINVAL;
}
request = osif_request_alloc(&params);
if (!request) {
hdd_err("Request allocation failure");