From dfca3d8173c1548a97e558cb8abd1ffd2483f8b7 Mon Sep 17 00:00:00 2001
From: Himanshu Agarwal <himanaga@codeaurora.org>
Date: Fri, 6 Oct 2017 12:40:27 +0530
Subject: [PATCH] qcacld-3.0: Add sanity check for vdev id to prevent OOB
 access

Add sanity check for vdev id in wma_vdev_start_resp_handler() to prevent
out of bound memory access.

Change-Id: Ia4e18e8e322142928c41dfa88b874ff017727266
CRs-Fixed: 2120424
---
 core/wma/src/wma_dev_if.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/core/wma/src/wma_dev_if.c b/core/wma/src/wma_dev_if.c
index a69b17a1215b..c096cae1215f 100644
--- a/core/wma/src/wma_dev_if.c
+++ b/core/wma/src/wma_dev_if.c
@@ -960,6 +960,11 @@ int wma_vdev_start_resp_handler(void *handle, uint8_t *cmd_param_info,
 		return -EINVAL;
 	}
 
+	if (resp_event->vdev_id >= wma->max_bssid) {
+		WMA_LOGE("Invalid vdev id received from firmware");
+		return -EINVAL;
+	}
+
 	if (resp_event->status == QDF_STATUS_SUCCESS) {
 		wma->interfaces[resp_event->vdev_id].tx_streams =
 			resp_event->cfgd_tx_streams;