From d54655fb56abc2b3423850b265c6cc7945aae3f7 Mon Sep 17 00:00:00 2001 From: Pragaspathi Thilagaraj Date: Thu, 21 Nov 2019 18:42:30 +0530 Subject: [PATCH] qcacld-3.0: Validate number of requested EIDs in beacon request If the requested info field in beacon report request is present, the driver tries to allocate memory for the target beacon report EIDs from the number of requested EIDs received from the frame. In SLUB disabled builds, the qdf_mem_malloc function doesn't validate if the size provided is 0 and returns the value ZERO_SIZE_PTR(((void *)16)) for the pointer. When this pointer is dereferenced, it causes invalid address dereference. Since the number of requested EIDs is directly controlled by the frame sent by AP, validate this value before using it to allocate memory. Change-Id: Icbac3e952de0d7ae3144e9b319f2c51ccdf93ac5 CRs-Fixed: 2571480 --- core/mac/src/pe/rrm/rrm_api.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/core/mac/src/pe/rrm/rrm_api.c b/core/mac/src/pe/rrm/rrm_api.c index 7241a6517f1a..f550088b6e59 100644 --- a/core/mac/src/pe/rrm/rrm_api.c +++ b/core/mac/src/pe/rrm/rrm_api.c @@ -570,12 +570,18 @@ rrm_process_beacon_report_req(struct mac_context *mac, } if (pBeaconReq->measurement_request.Beacon.RequestedInfo.present) { + if (!pBeaconReq->measurement_request.Beacon.RequestedInfo. + num_requested_eids) { + pe_debug("802.11k BCN RPT: Requested num of EID is 0"); + return eRRM_FAILURE; + } pCurrentReq->request.Beacon.reqIes.pElementIds = qdf_mem_malloc(sizeof(uint8_t) * pBeaconReq->measurement_request.Beacon. RequestedInfo.num_requested_eids); if (!pCurrentReq->request.Beacon.reqIes.pElementIds) return eRRM_FAILURE; + pCurrentReq->request.Beacon.reqIes.num = pBeaconReq->measurement_request.Beacon.RequestedInfo. num_requested_eids; @@ -583,6 +589,11 @@ rrm_process_beacon_report_req(struct mac_context *mac, pBeaconReq->measurement_request.Beacon. RequestedInfo.requested_eids, pCurrentReq->request.Beacon.reqIes.num); + pe_debug("802.11k BCN RPT: Requested EIDs: num:[%d]", + pCurrentReq->request.Beacon.reqIes.num); + QDF_TRACE_HEX_DUMP(QDF_MODULE_ID_PE, QDF_TRACE_LEVEL_DEBUG, + pCurrentReq->request.Beacon.reqIes.pElementIds, + pCurrentReq->request.Beacon.reqIes.num); } /* Prepare the request to send to SME. */