qcacld-3.0: Specify policy for vendor attribute

Currently, there are some attributes that dont have any NLA policy
specified. The absence of policy results the attribute to default to
NLA_UNSPEC. When handling this case in validate_nla() there is no
minimum length guarantee, meaning that the attribute can have zero
length. This will result in a one byte overread when calling
nla_get_u8().

To avoid this potential security vulnerability, add policy entry for the
attribute.

Change-Id: I19e5a032ccb2083d5f204be6ff7ac2f53aebf130
CRs-Fixed: 2408072
Tento commit je obsažen v:
Sourav Mohapatra
2019-03-19 14:31:20 +05:30
odevzdal nshrivas
rodič a1eb745130
revize 0dbdfb482d

Zobrazit soubor

@@ -5245,6 +5245,9 @@ static const struct nla_policy
wlan_hdd_wifi_config_policy[QCA_WLAN_VENDOR_ATTR_CONFIG_MAX + 1] = {
[QCA_WLAN_VENDOR_ATTR_CONFIG_MODULATED_DTIM] = {.type = NLA_U32 },
[QCA_WLAN_VENDOR_ATTR_CONFIG_IGNORE_ASSOC_DISALLOWED] = {
.type = NLA_U8 },
[QCA_WLAN_VENDOR_ATTR_CONFIG_DISABLE_FILS] = {.type = NLA_U8 },
[QCA_WLAN_VENDOR_ATTR_CONFIG_STATS_AVG_FACTOR] = {.type = NLA_U16 },
[QCA_WLAN_VENDOR_ATTR_CONFIG_GUARD_TIME] = {.type = NLA_U32 },
[QCA_WLAN_VENDOR_ATTR_CONFIG_FINE_TIME_MEASUREMENT] = {.type = NLA_U32},