A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix uninitialized buffer use in wma_mgmt_rx_process

Browse source 
In the function wma_mgmt_rx_process, wbuf is the allocated skb
which houses the incoming management frame. An extra 100 bytes
buffer is allocated in wbuf->data to avoid OOB access when
additional headers are present in addition to ieee80211_frame.
This additional buffer is uninitialized and can cause potential
OOB for the management frames of length
sizeof(struct ieee80211_frame) and have no IE or any data.

Initialize the allocated extra bytes so that OOB is prevented.

Change-Id: I44047b0c6f3a731c741c5e0217f3bd0cdd8ed4dc
CRs-Fixed: 2249815
This commit is contained in:
Pragaspathi Thilagaraj 2018-06-05 17:11:35 +05:30 • committed by nshrivas
commit b3bceade65
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
core/wma/src/wma_mgmt.c
View file

@ -4112,6 +4112,10 @@ static int wma_mgmt_rx_process(void *handle, uint8_t *data,
qdf_nbuf_put_tail(wbuf, mgmt_rx_params->buf_len);
qdf_nbuf_set_protocol(wbuf, ETH_P_CONTROL);
qdf_mem_zero(((uint8_t *)qdf_nbuf_data(wbuf) + mgmt_rx_params->buf_len),
(roundup(mgmt_rx_params->buf_len + RESERVE_BYTES, 4) -
mgmt_rx_params->buf_len));
wma_mem_endianness_based_copy(qdf_nbuf_data(wbuf),
bufp, mgmt_rx_params->buf_len);