Jelajahi Sumber

qcacld-3.0: Add check for vdev_id in wma_p2p_lo_event_handler

Currently fix_param->vdev_id, recevied from the FW, is directly used
to refer to wma->interfaces without validating if the vdev_id is valid.

Add sanity check to make sure vdev_id is less than max_bssid before
using it.

Change-Id: I92743589e0333449c39e148b37d200cac2cdb817
CRs-Fixed: 2119434
Vignesh Viswanathan 7 tahun lalu
induk
melakukan
18827b06d7
1 mengubah file dengan 5 tambahan dan 0 penghapusan
  1. 5 0
      core/wma/src/wma_features.c

+ 5 - 0
core/wma/src/wma_features.c

@@ -4850,6 +4850,11 @@ int wma_p2p_lo_event_handler(void *handle, uint8_t *event_buf,
 	param_tlvs = (WMI_P2P_LISTEN_OFFLOAD_STOPPED_EVENTID_param_tlvs *)
 								event_buf;
 	fix_param = param_tlvs->fixed_param;
+	if (fix_param->vdev_id >= wma->max_bssid) {
+		WMA_LOGE("%s: received invalid vdev_id %d",
+			 __func__, fix_param->vdev_id);
+		return -EINVAL;
+	}
 	event = qdf_mem_malloc(sizeof(*event));
 	if (event == NULL) {
 		WMA_LOGE("Event allocation failed");