A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 22:40:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix buffer overwrite in lim_send_probe_rsp_template_to_hal

Browse source 
In function lim_send_probe_rsp_template_to_hal, memset is done for the
allocated packet for length nBytes which is calculated as size of payload +
MAC header + addn_ielen.
However, the buffer used psessionEntry->pSchProbeRspTemplate is allocated
for length 512 (SCH_MAX_PROBE_RESP_SIZE) only as part of create session.
This leads to a potential overflow of the memory if nBytes calculated is
greater than 512 leading to kernel panic while freeing the memory in
delete session.

Add sanity check to make sure we do not exceed the SCH_MAX_PROBE_RESP_SIZE
before doing a memset on the buffer.

Change-Id: I4657d34a429b1f0c11ac8ca24869727c222669b8
CRs-Fixed: 2160086
This commit is contained in:
Vignesh Viswanathan 2017-12-18 17:48:02 +05:30 • committed by snandini
commit bdfbaa9cbf
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
core/mac/src/pe/sch/sch_api.c
View file

@ -345,6 +345,13 @@ uint32_t lim_send_probe_rsp_template_to_hal(tpAniSirGlobal pMac,
nBytes += nPayload + sizeof(tSirMacMgmtHdr);
/* Make sure we are not exceeding allocated len */
if (nBytes > SCH_MAX_PROBE_RESP_SIZE) {
pe_err("nBytes %d greater than max size", nBytes);
qdf_mem_free(addIE);
return eSIR_FAILURE;
}
/* Paranoia: */
qdf_mem_set(pFrame2Hal, nBytes, 0);