Просмотр исходного кода

qcacld-3.0: Specify policy for vendor attribute

Currently, there are some attributes that dont have any NLA policy
specified. The absence of policy results the attribute to default to
NLA_UNSPEC. When handling this case in validate_nla() there is no
minimum length guarantee, meaning that the attribute can have zero
length. This will result in a one byte overread when calling
nla_get_u8().

To avoid this potential security vulnerability, add policy entry for the
attribute.

Change-Id: I19e5a032ccb2083d5f204be6ff7ac2f53aebf130
CRs-Fixed: 2408072
Sourav Mohapatra 6 лет назад
Родитель
Сommit
0dbdfb482d
1 измененных файлов с 3 добавлено и 0 удалено
  1. 3 0
      core/hdd/src/wlan_hdd_cfg80211.c

+ 3 - 0
core/hdd/src/wlan_hdd_cfg80211.c

@@ -5245,6 +5245,9 @@ static const struct nla_policy
 wlan_hdd_wifi_config_policy[QCA_WLAN_VENDOR_ATTR_CONFIG_MAX + 1] = {
 
 	[QCA_WLAN_VENDOR_ATTR_CONFIG_MODULATED_DTIM] = {.type = NLA_U32 },
+	[QCA_WLAN_VENDOR_ATTR_CONFIG_IGNORE_ASSOC_DISALLOWED] = {
+		.type = NLA_U8 },
+	[QCA_WLAN_VENDOR_ATTR_CONFIG_DISABLE_FILS] = {.type = NLA_U8 },
 	[QCA_WLAN_VENDOR_ATTR_CONFIG_STATS_AVG_FACTOR] = {.type = NLA_U16 },
 	[QCA_WLAN_VENDOR_ATTR_CONFIG_GUARD_TIME] = {.type = NLA_U32 },
 	[QCA_WLAN_VENDOR_ATTR_CONFIG_FINE_TIME_MEASUREMENT] = {.type = NLA_U32},