A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 16:46:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Validate number of requested EIDs in beacon request

Browse source 
If the requested info field in beacon report request is present,
the driver tries to allocate memory for the target beacon report
EIDs from the number of requested EIDs received from the frame.
In SLUB disabled builds, the qdf_mem_malloc function doesn't
validate if the size provided is 0 and returns the value
ZERO_SIZE_PTR(((void *)16)) for the pointer. When this pointer
is dereferenced, it causes invalid address dereference.

Since the number of requested EIDs is directly controlled by the
frame sent by AP, validate this value before using it to allocate
memory.

Change-Id: Icbac3e952de0d7ae3144e9b319f2c51ccdf93ac5
CRs-Fixed: 2571480
This commit is contained in:
Pragaspathi Thilagaraj 2019-11-21 18:42:30 +05:30 • committed by nshrivas
commit d54655fb56
1 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
core/mac/src/pe/rrm/rrm_api.c
View file

@ -570,12 +570,18 @@ rrm_process_beacon_report_req(struct mac_context *mac,
}
if (pBeaconReq->measurement_request.Beacon.RequestedInfo.present) {
if (!pBeaconReq->measurement_request.Beacon.RequestedInfo.
num_requested_eids) {
pe_debug("802.11k BCN RPT: Requested num of EID is 0");
return eRRM_FAILURE;
}
pCurrentReq->request.Beacon.reqIes.pElementIds =
qdf_mem_malloc(sizeof(uint8_t) *
pBeaconReq->measurement_request.Beacon.
RequestedInfo.num_requested_eids);
if (!pCurrentReq->request.Beacon.reqIes.pElementIds)
return eRRM_FAILURE;
pCurrentReq->request.Beacon.reqIes.num =
pBeaconReq->measurement_request.Beacon.RequestedInfo.
num_requested_eids;
@ -583,6 +589,11 @@ rrm_process_beacon_report_req(struct mac_context *mac,
pBeaconReq->measurement_request.Beacon.
RequestedInfo.requested_eids,
pCurrentReq->request.Beacon.reqIes.num);
pe_debug("802.11k BCN RPT: Requested EIDs: num:[%d]",
pCurrentReq->request.Beacon.reqIes.num);
QDF_TRACE_HEX_DUMP(QDF_MODULE_ID_PE, QDF_TRACE_LEVEL_DEBUG,
pCurrentReq->request.Beacon.reqIes.pElementIds,
pCurrentReq->request.Beacon.reqIes.num);
}
/* Prepare the request to send to SME. */