浏览代码

qcacld-3.0: Fix potential buffer overflow in ol_txrx_update_tx_queue_groups

Check for the validity of group_id when received the htt message of
HTT_T2H_MSG_TYPE_TX_CREDIT_UPDATE_IND from firmware to ensure the buffer
overflow does not happen.

Change-Id: I17ac9f37a1450f32fb080c3b22f6317b6238068c
CRs-Fixed: 2148610
Tiger Yu 7 年之前
父节点
当前提交
1e553e5aa3
共有 1 个文件被更改,包括 7 次插入0 次删除
  1. 7 0
      core/dp/txrx/ol_txrx.c

+ 7 - 0
core/dp/txrx/ol_txrx.c

@@ -588,6 +588,13 @@ void ol_txrx_update_tx_queue_groups(
 	u_int32_t membership;
 	struct ol_txrx_vdev_t *vdev;
 
+	if (group_id >= OL_TX_MAX_TXQ_GROUPS) {
+		ol_txrx_warn("%s: invalid group_id=%u, ignore update.\n",
+			__func__,
+			group_id);
+		return;
+	}
+
 	group = &pdev->txq_grps[group_id];
 
 	membership = OL_TXQ_GROUP_MEMBERSHIP_GET(vdev_id_mask, ac_mask);