From e0dd94dd4ca6190b1aa550999f3f22d28fc60d93 Mon Sep 17 00:00:00 2001 From: Kai Chen Date: Fri, 7 Jun 2019 13:10:49 -0700 Subject: [PATCH] qcacmn: Add user id range check to prevent out of range access A random crash may be caused by out of range access. Add MU user id check to prevent out of range access. Change-Id: I531d6c03024c4a6af4e0db97ea00d0874aaef387 --- hal/wifi3.0/hal_api_mon.h | 2 +- hal/wifi3.0/hal_generic_api.h | 20 +++++++++++--------- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/hal/wifi3.0/hal_api_mon.h b/hal/wifi3.0/hal_api_mon.h index 9103832898f3..c4ff12da3b72 100644 --- a/hal/wifi3.0/hal_api_mon.h +++ b/hal/wifi3.0/hal_api_mon.h @@ -71,7 +71,7 @@ #define HAL_TLV_STATUS_MSDU_START 7 #define HAL_TLV_STATUS_MSDU_END 8 -#define HAL_MAX_UL_MU_USERS 8 +#define HAL_MAX_UL_MU_USERS 37 #define HAL_RX_PKT_TYPE_11A 0 #define HAL_RX_PKT_TYPE_11B 1 diff --git a/hal/wifi3.0/hal_generic_api.h b/hal/wifi3.0/hal_generic_api.h index 2bc2490aea39..2a0896f52e58 100644 --- a/hal/wifi3.0/hal_generic_api.h +++ b/hal/wifi3.0/hal_generic_api.h @@ -449,17 +449,19 @@ hal_rx_status_get_tlv_info_generic(void *rx_tlv_hdr, void *ppduinfo, default: break; } + if (user_id < HAL_MAX_UL_MU_USERS) { + mon_rx_user_status = + &ppdu_info->rx_user_status[user_id]; - mon_rx_user_status = &ppdu_info->rx_user_status[user_id]; + mon_rx_user_status->mcs = + HAL_RX_GET(rx_tlv, RX_PPDU_END_USER_STATS_1, + MCS); + mon_rx_user_status->nss = + HAL_RX_GET(rx_tlv, RX_PPDU_END_USER_STATS_1, + NSS); - mon_rx_user_status->mcs = - HAL_RX_GET(rx_tlv, RX_PPDU_END_USER_STATS_1, - MCS); - mon_rx_user_status->nss = - HAL_RX_GET(rx_tlv, RX_PPDU_END_USER_STATS_1, - NSS); - - hal_rx_handle_ofdma_info(rx_tlv, mon_rx_user_status); + hal_rx_handle_ofdma_info(rx_tlv, mon_rx_user_status); + } ppdu_info->com_info.mpdu_cnt_fcs_ok = HAL_RX_GET(rx_tlv, RX_PPDU_END_USER_STATS_3,