A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 08:36:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Add bound check for desc_id

Browse source 
Add bound check for desc_id in tgt_mgmt_txrx_tx_completion_handler()
to check OOB issue.

Change-Id: Ib28852a1c1ccf06af14004bf4001ce0938391f3d
CRs-Fixed: 2318632
This commit is contained in:
Harprit Chhabada 2018-09-27 15:46:50 -07:00 • committed by nshrivas
commit ff17327ad5
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
umac/cmn_services/mgmt_txrx/dispatcher/src/wlan_mgmt_txrx_tgt_api.c
View file

@ -1025,6 +1025,10 @@ QDF_STATUS tgt_mgmt_txrx_tx_completion_handler(
mgmt_txrx_err("Mgmt txrx context empty for pdev %pK", pdev);
return QDF_STATUS_E_NULL_VALUE;
}
if (desc_id >= MGMT_DESC_POOL_MAX) {
mgmt_txrx_err("desc_id:%u is out of bounds", desc_id);
return QDF_STATUS_E_INVAL;
}
mgmt_desc = &mgmt_txrx_pdev_ctx->mgmt_desc_pool.pool[desc_id];
if (!mgmt_desc) {
mgmt_txrx_err("Mgmt desc empty for id %d pdev %pK ",