samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
複製 0
程式碼 問題管理 合併請求 Actions Packages Projects 版本發佈 Wiki Activity

qcacld-3.0: Avoid overread when configuring MAC addresses

瀏覽代碼 
Currently there are multiple cfg80211 vendor commands where MAC
address attributes are defined in a nla_policy table with a type of
NLA_UNSPEC but without a minimum length. Add the proper minimum length
to avoid buffer overread.

Change-Id: I11ff2bd813dc4e6784a7cdee66a0c10ca0e69fcf
CRs-Fixed: 2062140
This commit is contained in:
Jeff Johnson
2017-06-15 14:51:26 -07:00
committed by snandini
父節點 899f5bcc20
當前提交 19a5a7ef67
共有 3 個文件被更改，包括 17 次插入 和 6 次删除
Download Patch File Download Diff File Expand all files Collapse all files

4
core/hdd/src/wlan_hdd_cfg80211.c
查看文件

@@ -4829,7 +4829,9 @@ wlan_hdd_wifi_config_policy[QCA_WLAN_VENDOR_ATTR_CONFIG_MAX + 1] = {
[RX_REORDER_TIMEOUT_VIDEO] = {.type = NLA_U32},
[RX_REORDER_TIMEOUT_BESTEFFORT] = {.type = NLA_U32},
[RX_REORDER_TIMEOUT_BACKGROUND] = {.type = NLA_U32},
[RX_BLOCKSIZE_PEER_MAC] = {.type = NLA_UNSPEC},
[RX_BLOCKSIZE_PEER_MAC] = {
.type = NLA_UNSPEC,
.len = QDF_MAC_ADDR_SIZE},
[RX_BLOCKSIZE_WINLIMIT] = {.type = NLA_U32},
};

3
core/hdd/src/wlan_hdd_ext_scan.c
查看文件

@@ -93,7 +93,8 @@ static const struct nla_policy wlan_hdd_extscan_config_policy
[QCA_WLAN_VENDOR_ATTR_EXTSCAN_GET_CACHED_SCAN_RESULTS_CONFIG_PARAM_MAX] = {
.type = NLA_U32},
[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_BSSID] = {
.type = NLA_UNSPEC},
.type = NLA_UNSPEC,
.len = QDF_MAC_ADDR_SIZE},
[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_RSSI_LOW] = {
.type = NLA_S32},
[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_RSSI_HIGH] = {

16
core/hdd/src/wlan_hdd_tdls.c
查看文件

@@ -3253,7 +3253,9 @@ int wlan_hdd_tdls_get_status(hdd_adapter_t *pAdapter,
static const struct nla_policy
wlan_hdd_tdls_config_enable_policy[QCA_WLAN_VENDOR_ATTR_TDLS_ENABLE_MAX +
1] = {
[QCA_WLAN_VENDOR_ATTR_TDLS_ENABLE_MAC_ADDR] = {.type = NLA_UNSPEC},
[QCA_WLAN_VENDOR_ATTR_TDLS_ENABLE_MAC_ADDR] = {
.type = NLA_UNSPEC,
.len = QDF_MAC_ADDR_SIZE},
[QCA_WLAN_VENDOR_ATTR_TDLS_ENABLE_CHANNEL] = {.type = NLA_U32},
[QCA_WLAN_VENDOR_ATTR_TDLS_ENABLE_GLOBAL_OPERATING_CLASS] = {.type =
NLA_U32},
@@ -3264,12 +3266,16 @@ static const struct nla_policy
static const struct nla_policy
wlan_hdd_tdls_config_disable_policy[QCA_WLAN_VENDOR_ATTR_TDLS_DISABLE_MAX +
1] = {
[QCA_WLAN_VENDOR_ATTR_TDLS_DISABLE_MAC_ADDR] = {.type = NLA_UNSPEC},
[QCA_WLAN_VENDOR_ATTR_TDLS_DISABLE_MAC_ADDR] = {
.type = NLA_UNSPEC,
.len = QDF_MAC_ADDR_SIZE},
};
static const struct nla_policy
wlan_hdd_tdls_config_state_change_policy[QCA_WLAN_VENDOR_ATTR_TDLS_STATE_MAX
+ 1] = {
[QCA_WLAN_VENDOR_ATTR_TDLS_STATE_MAC_ADDR] = {.type = NLA_UNSPEC},
[QCA_WLAN_VENDOR_ATTR_TDLS_STATE_MAC_ADDR] = {
.type = NLA_UNSPEC,
.len = QDF_MAC_ADDR_SIZE},
[QCA_WLAN_VENDOR_ATTR_TDLS_NEW_STATE] = {.type = NLA_U32},
[QCA_WLAN_VENDOR_ATTR_TDLS_STATE_REASON] = {.type = NLA_S32},
[QCA_WLAN_VENDOR_ATTR_TDLS_STATE_CHANNEL] = {.type = NLA_U32},
@@ -3279,7 +3285,9 @@ static const struct nla_policy
static const struct nla_policy
wlan_hdd_tdls_config_get_status_policy
[QCA_WLAN_VENDOR_ATTR_TDLS_GET_STATUS_MAX + 1] = {
[QCA_WLAN_VENDOR_ATTR_TDLS_GET_STATUS_MAC_ADDR] = {.type = NLA_UNSPEC},
[QCA_WLAN_VENDOR_ATTR_TDLS_GET_STATUS_MAC_ADDR] = {
.type = NLA_UNSPEC,
.len = QDF_MAC_ADDR_SIZE},
[QCA_WLAN_VENDOR_ATTR_TDLS_GET_STATUS_STATE] = {.type = NLA_U32},
[QCA_WLAN_VENDOR_ATTR_TDLS_GET_STATUS_REASON] = {.type = NLA_S32},
[QCA_WLAN_VENDOR_ATTR_TDLS_GET_STATUS_CHANNEL] = {.type = NLA_U32},