A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-25 22:23:14 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Validate vendor command do_acs

Browse source 
Currently attributes are not validated in __wlan_hdd_cfg80211_do_acs,
this can lead to a buffer overread.

To resolve this issue, Define an nla_policy and validate the
attributes.

CRs-Fixed: 2054685
Change-Id: Ic1bd5abbef09407f925625b709f10cf9cb7c3d7f
This commit is contained in:
Ashish Kumar Dhanotiya 2017-06-08 19:31:15 +05:30 • committed by snandini
commit cc770eb720
1 changed files with 13 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

26
core/hdd/src/wlan_hdd_cfg80211.c
View file

@ -2055,8 +2055,19 @@ static int hdd_create_acs_timer(hdd_adapter_t *adapter)
return 0;
}
static const struct nla_policy
wlan_hdd_cfg80211_do_acs_policy[QCA_WLAN_VENDOR_ATTR_ACS_MAX+1] = {
[QCA_WLAN_VENDOR_ATTR_ACS_HW_MODE] = { .type = NLA_U8 },
[QCA_WLAN_VENDOR_ATTR_ACS_HT_ENABLED] = { .type = NLA_FLAG },
[QCA_WLAN_VENDOR_ATTR_ACS_HT40_ENABLED] = { .type = NLA_FLAG },
[QCA_WLAN_VENDOR_ATTR_ACS_VHT_ENABLED] = { .type = NLA_FLAG },
[QCA_WLAN_VENDOR_ATTR_ACS_CHWIDTH] = { .type = NLA_U16 },
[QCA_WLAN_VENDOR_ATTR_ACS_CH_LIST] = { .type = NLA_UNSPEC },
[QCA_WLAN_VENDOR_ATTR_ACS_FREQ_LIST] = { .type = NLA_UNSPEC },
};
/**
* __wlan_hdd_cfg80211_do_acs : CFG80211 handler function for DO_ACS Vendor CMD
* __wlan_hdd_cfg80211_do_acs(): CFG80211 handler function for DO_ACS Vendor CMD
* @wiphy: Linux wiphy struct pointer
* @wdev: Linux wireless device struct pointer
* @data: ACS information from hostapd
@ -2090,17 +2101,6 @@ static int __wlan_hdd_cfg80211_do_acs(struct wiphy *wiphy,
* config shall be set only from start_acs.
*/
/* nla_policy Policy template. Policy not applied as some attributes are
* optional and QCA_WLAN_VENDOR_ATTR_ACS_CH_LIST has variable length
*
* [QCA_WLAN_VENDOR_ATTR_ACS_HW_MODE] = { .type = NLA_U8 },
* [QCA_WLAN_VENDOR_ATTR_ACS_HT_ENABLED] = { .type = NLA_FLAG },
* [QCA_WLAN_VENDOR_ATTR_ACS_HT40_ENABLED] = { .type = NLA_FLAG },
* [QCA_WLAN_VENDOR_ATTR_ACS_VHT_ENABLED] = { .type = NLA_FLAG },
* [QCA_WLAN_VENDOR_ATTR_ACS_CHWIDTH] = { .type = NLA_U16 },
* [QCA_WLAN_VENDOR_ATTR_ACS_CH_LIST] = { .type = NLA_NESTED },
*/
ENTER_DEV(ndev);
if (QDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
@ -2128,7 +2128,7 @@ static int __wlan_hdd_cfg80211_do_acs(struct wiphy *wiphy,
qdf_mem_zero(&sap_config->acs_cfg, sizeof(struct sap_acs_cfg));
status = nla_parse(tb, QCA_WLAN_VENDOR_ATTR_ACS_MAX, data, data_len,
NULL);
wlan_hdd_cfg80211_do_acs_policy);
if (status) {
hdd_err("Invalid ATTR");
goto out;