A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 16:16:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix Use after free in wma_vdev_start_resp_handler

Browse source 
In the function wma_vdev_start_resp_handler when we recieve a
vdev start response event, we copy the req_msg->user_data to the
object hidden_ssid_restart of the structure
tpHalHiddenSsidVdevRestart. If hidden_ssid_restart_in_progress
flag is set for the corresponding vdev_id, then we post that
message to the PE and free the hidden_ssid_restart. If this
req_msg->user_data is used again if req_msg->msg_type is
WMA_CHNL_SWITCH_REQ , then a possible Use-After-Free will occur
in  wma_vdev_start_resp_handler.

When a channel switch request has occured, there will not be a
hidden ssid restart event in progress. So add check to validate
if the req_msg->msg_type == WMA_HIDDEN_SSID_VDEV_RESTART.

Change-Id: Ie3195b23ff136fbfd38fcd4d32e993d4cb016316
CRs-Fixed: 2216751
This commit is contained in:
Pragaspathi Thilagaraj 2018-04-13 18:53:50 +05:30 • committed by nshrivas
commit b9c4674fda
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
core/wma/src/wma_dev_if.c
View file

@ -1214,7 +1214,8 @@ int wma_vdev_start_resp_handler(void *handle, uint8_t *cmd_param_info,
if ((resp_event->vdev_id < wma->max_bssid) &&
(qdf_atomic_read(
&wma->interfaces[resp_event->vdev_id].vdev_restart_params.hidden_ssid_restart_in_progress))
&& (wma_is_vdev_in_ap_mode(wma, resp_event->vdev_id) == true)) {
&& (wma_is_vdev_in_ap_mode(wma, resp_event->vdev_id) == true)
&& (req_msg->msg_type == WMA_HIDDEN_SSID_VDEV_RESTART)) {
tpHalHiddenSsidVdevRestart hidden_ssid_restart =
(tpHalHiddenSsidVdevRestart)req_msg->user_data;
WMA_LOGE("%s: vdev restart event recevied for hidden ssid set using IOCTL",