Browse Source

qcacld-3.0: Add sanity check for vdev_id in wma_wow_wakeup_host_event

Currently wake_info->vdev_id, recevied from the FW, is directly used
to refer to wma->interfaces without validating if the vdev_id is valid.

Add sanity check to make sure vdev_id is less than max_bssid before
using it.

Change-Id: I66be7d15f370d0204e25c3d0ea60c0c9f5912005
CRs-Fixed: 2121059
Vignesh Viswanathan 7 years ago
parent
commit
1f6e08faea
1 changed files with 7 additions and 0 deletions
  1. 7 0
      core/wma/src/wma_features.c

+ 7 - 0
core/wma/src/wma_features.c

@@ -2769,6 +2769,13 @@ int wma_wow_wakeup_host_event(void *handle, uint8_t *event, uint32_t len)
 	}
 
 	wake_info = event_param->fixed_param;
+
+	if (wake_info->vdev_id >= wma->max_bssid) {
+		WMA_LOGE("%s: received invalid vdev_id %d",
+			 __func__, wake_info->vdev_id);
+		return -EINVAL;
+	}
+
 	wma_wake_event_log_reason(wma, wake_info);
 
 	pmo_ucfg_psoc_wakeup_host_event_received(wma->psoc);