From ded9d2dc571c9fc01a54fd101c5ed0c642738434 Mon Sep 17 00:00:00 2001 From: Zhu Jianmin Date: Thu, 22 Jun 2017 09:39:36 +0800 Subject: [PATCH] qcacld-3.0: Prevent memory issue with more check Add session_id range check etc Change-Id: I749076a5f060873702b42ac4908e3220e805c349 CRs-Fixed: 2061117 --- core/hdd/src/wlan_hdd_hostapd.c | 4 ++-- core/hdd/src/wlan_hdd_ipa.c | 6 +++++- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/core/hdd/src/wlan_hdd_hostapd.c b/core/hdd/src/wlan_hdd_hostapd.c index baddba974f5f..6d987bf54024 100644 --- a/core/hdd/src/wlan_hdd_hostapd.c +++ b/core/hdd/src/wlan_hdd_hostapd.c @@ -7011,8 +7011,8 @@ int wlan_hdd_cfg80211_update_apies(hdd_adapter_t *adapter) proberesp_ies = qdf_mem_malloc(beacon->proberesp_ies_len + MAX_GENIE_LEN); if (proberesp_ies == NULL) { - hdd_err("mem alloc failed for probe resp ies %d", - proberesp_ies_len); + hdd_err("mem alloc failed for probe resp ies, size: %d", + beacon->proberesp_ies_len + MAX_GENIE_LEN); ret = -EINVAL; goto done; } diff --git a/core/hdd/src/wlan_hdd_ipa.c b/core/hdd/src/wlan_hdd_ipa.c index a2f59d567aca..3610b66284bb 100644 --- a/core/hdd/src/wlan_hdd_ipa.c +++ b/core/hdd/src/wlan_hdd_ipa.c @@ -2641,7 +2641,11 @@ static void hdd_ipa_uc_offload_enable_disable(hdd_adapter_t *adapter, "Interface context is NULL"); return; } - + if (session_id >= CSR_ROAM_SESSION_MAX) { + HDD_IPA_LOG(QDF_TRACE_LEVEL_ERROR, + "invalid session id: %d", session_id); + return; + } if (enable == hdd_ipa->vdev_offload_enabled[session_id]) { /* IPA offload status is already set as desired */ HDD_IPA_LOG(QDF_TRACE_LEVEL_ERROR,