From c69a241cd99da17fe666564deaaebe07bf40fefc Mon Sep 17 00:00:00 2001 From: Aditya Kodukula Date: Wed, 8 Jan 2025 11:55:23 -0800 Subject: [PATCH] qcacld-3.0: Fix potential OOB memory access Currently in the wma_stats_ext_event_handler(), the buf_ptr is not pointing correctly to the event data received from FW. This is leading to an OOB memory access during qdf_mem_copy(). So, to avoid this issue correctly point the buf_ptr to the event data sent by the FW in the TLV. Change-Id: Iffa3e96a6a36eff5899a7a9a7febe0ebb9d7878f CRs-Fixed: 4011656 --- core/wma/src/wma_utils.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c index e8f10039e0ad..3f34979096b8 100644 --- a/core/wma/src/wma_utils.c +++ b/core/wma/src/wma_utils.c @@ -1,6 +1,6 @@ /* * Copyright (c) 2013-2021 The Linux Foundation. All rights reserved. - * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -708,7 +708,6 @@ int wma_stats_ext_event_handler(void *handle, uint8_t *event_buf, } stats_ext_info = param_buf->fixed_param; - buf_ptr = (uint8_t *)stats_ext_info; alloc_len = sizeof(tSirStatsExtEvent); alloc_len += stats_ext_info->data_len; @@ -725,7 +724,7 @@ int wma_stats_ext_event_handler(void *handle, uint8_t *event_buf, if (!stats_ext_event) return -ENOMEM; - buf_ptr += sizeof(wmi_stats_ext_event_fixed_param) + WMI_TLV_HDR_SIZE; + buf_ptr = (uint8_t *)param_buf->data; stats_ext_event->vdev_id = stats_ext_info->vdev_id; stats_ext_event->event_data_len = stats_ext_info->data_len; @@ -775,7 +774,6 @@ int wma_stats_ext_event_handler(void *handle, uint8_t *event_buf, } stats_ext_info = param_buf->fixed_param; - buf_ptr = (uint8_t *)stats_ext_info; alloc_len = sizeof(tSirStatsExtEvent); alloc_len += stats_ext_info->data_len; @@ -791,7 +789,7 @@ int wma_stats_ext_event_handler(void *handle, uint8_t *event_buf, if (!stats_ext_event) return -ENOMEM; - buf_ptr += sizeof(wmi_stats_ext_event_fixed_param) + WMI_TLV_HDR_SIZE; + buf_ptr = (uint8_t *)param_buf->data; stats_ext_event->vdev_id = stats_ext_info->vdev_id; stats_ext_event->event_data_len = stats_ext_info->data_len;