A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 21:59:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Catch potential OOB for 6G channel list

Browse source 
Ensure any access to the master channel list does not go out of bounds

Change-Id: I96487a752d1510136f1ecbf92da42eb7b991522b
CRs-fixed: 2900945
This commit is contained in:
Lincoln Tran 2021-03-16 17:36:39 -07:00 • committed by Madan Koyyalamudi
commit fc2b7d2152
1 changed files with 15 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

17
umac/regulatory/core/src/reg_build_chan_list.c
View file

@ -1023,8 +1023,16 @@ static void
reg_append_mas_chan_list_for_6g(struct wlan_regulatory_pdev_priv_obj
*pdev_priv_obj)
{
struct regulatory_channel *master_chan_list_6g_client =
pdev_priv_obj->mas_chan_list_6g_client
struct regulatory_channel *master_chan_list_6g_client;
if (pdev_priv_obj->reg_cur_6g_ap_pwr_type >= REG_CURRENT_MAX_AP_TYPE ||
pdev_priv_obj->reg_cur_6g_client_mobility_type >=
REG_MAX_CLIENT_TYPE) {
reg_debug("invalid 6G AP or client power type");
return;
}
master_chan_list_6g_client = pdev_priv_obj->mas_chan_list_6g_client
[pdev_priv_obj->reg_cur_6g_ap_pwr_type]
[pdev_priv_obj->reg_cur_6g_client_mobility_type];
@ -1040,6 +1048,11 @@ reg_append_mas_chan_list_for_6g(struct wlan_regulatory_pdev_priv_obj
{
enum reg_6g_ap_type ap_pwr_type = pdev_priv_obj->reg_cur_6g_ap_pwr_type;
if (ap_pwr_type >= REG_CURRENT_MAX_AP_TYPE) {
reg_debug("invalid 6G AP power type");
return;
}
qdf_mem_copy(&pdev_priv_obj->mas_chan_list[MIN_6GHZ_CHANNEL],
pdev_priv_obj->mas_chan_list_6g_ap[ap_pwr_type],
NUM_6GHZ_CHANNELS * sizeof(struct regulatory_channel));