From ae92ea605fcc98dcc5325e0c6bc7b2cb3b3860e5 Mon Sep 17 00:00:00 2001 From: Hariharan Basuthkar Date: Fri, 19 Jun 2020 12:30:45 +0530 Subject: [PATCH] qcacmn: Fix KW issue in the regulatory component In I3c82e2eb98cdaf0ff8754bd990529a1833276304, KW error is reported in the function, reg_compute_chan_to_freq. This is because min_chan_range and max_chan_range can be assigned values, that can cause array out of bounds issue. To fix the issue, add explicit range checks against min_chan_range and max_chang_range before iterating through master_chan_list to avoid out of bound access. Change-Id: Id5cd032fb899475720080b29012a6de1b5d4a916 CRs-Fixed: 2727082 --- umac/regulatory/core/src/reg_services_common.c | 5 +++++ umac/regulatory/dispatcher/inc/reg_services_public_struct.h | 3 +++ 2 files changed, 8 insertions(+) diff --git a/umac/regulatory/core/src/reg_services_common.c b/umac/regulatory/core/src/reg_services_common.c index c4857aa1869b..3759edd87440 100644 --- a/umac/regulatory/core/src/reg_services_common.c +++ b/umac/regulatory/core/src/reg_services_common.c @@ -1753,6 +1753,11 @@ static uint16_t reg_compute_chan_to_freq(struct wlan_objmgr_pdev *pdev, return 0; } + if (min_chan_range < MIN_CHANNEL || max_chan_range > MAX_CHANNEL) { + reg_err_rl("Channel range is invalid"); + return 0; + } + chan_list = pdev_priv_obj->mas_chan_list; for (count = min_chan_range; count <= max_chan_range; count++) { diff --git a/umac/regulatory/dispatcher/inc/reg_services_public_struct.h b/umac/regulatory/dispatcher/inc/reg_services_public_struct.h index f5bcf0fc9118..247bb9ea6c77 100644 --- a/umac/regulatory/dispatcher/inc/reg_services_public_struct.h +++ b/umac/regulatory/dispatcher/inc/reg_services_public_struct.h @@ -438,6 +438,9 @@ enum channel_enum { NUM_CHANNELS, + MIN_CHANNEL = CHAN_ENUM_2412, + MAX_CHANNEL = (NUM_CHANNELS - 1), + MIN_24GHZ_CHANNEL = CHAN_ENUM_2412, MAX_24GHZ_CHANNEL = CHAN_ENUM_2484, NUM_24GHZ_CHANNELS = (MAX_24GHZ_CHANNEL - MIN_24GHZ_CHANNEL + 1),