A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-11-10 04:42:22 -05:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Avoid overflow of "significant change" params

Browse source 
This is a qcacld-2.0 to qcacld-3.0 propagation.

The wlan driver supports the following vendor command:
	QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_SIGNIFICANT_CHANGE

This command supplies a "number of APs" attribute as well as a list of
per-AP attributes.  However there is no validation that the number of
APs provided won't overflow the destination buffer.  In addition there
is no validation that the number of APs actually provided matches the
number of APs expected.

To address these issues:
* Verify that the expected number of APs doesn't exceed the maximum
  allowed number of APs
* Verify that the actual number of APs supplied doesn't exceed the
  expected number of APs
* Only process the actual number of supplied APs if it is less than
  the expected number of APs.

Change-Id: I0513ffbc4a38f1d7ddbc0815d3618fc9a2ea4f77
CRs-Fixed: 1095009
This commit is contained in:
Prakash Dhavali 2016-11-29 08:54:18 -08:00 • committed by qcabuildsw
commit b0888ed295
1 changed files with 18 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

18
core/hdd/src/wlan_hdd_ext_scan.c
View file

@ -2336,6 +2336,13 @@ __wlan_hdd_cfg80211_extscan_set_significant_change(struct wiphy *wiphy,
pReqMsg->numAp =
nla_get_u32(tb
[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_NUM_AP]);
if (pReqMsg->numAp > WLAN_EXTSCAN_MAX_SIGNIFICANT_CHANGE_APS) {
hdd_err("Number of AP %u exceeds max %u",
pReqMsg->numAp,
WLAN_EXTSCAN_MAX_SIGNIFICANT_CHANGE_APS);
goto fail;
}
pReqMsg->sessionId = pAdapter->sessionId;
hdd_notice("Number of AP %d Session Id %d",
pReqMsg->numAp, pReqMsg->sessionId);
@ -2344,6 +2351,12 @@ __wlan_hdd_cfg80211_extscan_set_significant_change(struct wiphy *wiphy,
nla_for_each_nested(apTh,
tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM],
rem) {
if (i == pReqMsg->numAp) {
hdd_warn("Ignoring excess AP");
break;
}
if (nla_parse
(tb2, QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX,
nla_data(apTh), nla_len(apTh),
@ -2388,6 +2401,11 @@ __wlan_hdd_cfg80211_extscan_set_significant_change(struct wiphy *wiphy,
i++;
}
if (i < pReqMsg->numAp) {
hdd_warn("Number of AP %u less than expected %u",
i, pReqMsg->numAp);
pReqMsg->numAp = i;
}
context = &ext_scan_context;
spin_lock(&context->context_lock);