A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 15:11:48 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Avoid buffer over-read in vendor scan

Browse source 
While processing QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN,
scan randomization attributes: SCAN_MAC and SCAN_MAC_MASK are not
validated using nla_policy for a minimum length check of
MAC_ADDR_SIZE (6 bytes) which can result in buffer over-read.

To address this, add nla_policy for randomization attributes.

Change-Id: I872e221b951809ca1e5c60b867be52b9fa738ddd
CRs-Fixed: 2232745
This commit is contained in:
Rajeev Kumar Sirasanagandla 2018-05-29 16:17:43 +05:30 • committed by nshrivas
commit cf88e3afef
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
core/hdd/src/wlan_hdd_scan.c
View file

@ -45,7 +45,6 @@
#endif
#include <qca_vendor.h>
#include <wlan_cfg80211_scan.h>
#include "wlan_utility.h"
#define MAX_RATES 12
@ -870,6 +869,10 @@ struct nla_policy scan_policy[QCA_WLAN_VENDOR_ATTR_SCAN_MAX + 1] = {
[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE] = {.type = NLA_U64},
[QCA_WLAN_VENDOR_ATTR_SCAN_IE] = {.type = NLA_BINARY,
.len = MAX_DEFAULT_SCAN_IE_LEN},
[QCA_WLAN_VENDOR_ATTR_SCAN_MAC] = {.type = NLA_UNSPEC,
.len = QDF_MAC_ADDR_SIZE},
[QCA_WLAN_VENDOR_ATTR_SCAN_MAC_MASK] = {.type = NLA_UNSPEC,
.len = QDF_MAC_ADDR_SIZE},
};
/**