Browse Source

qcacld-3.0: Fix possible OOB issue in ol_tx_desc_update_group_credit

Currently tx desc id is extracted from HTT message and it is used
without check. This may cause possible OOB array read. To address
this add check for valid tx desc id.

Change-Id: I121fc4d550aa587f00ec315e3a20dfb136f4d7af
CRs-Fixed: 2225461
Sravan Kumar Kairam 7 years ago
parent
commit
2be2792e2e
1 changed files with 5 additions and 0 deletions
  1. 5 0
      core/dp/txrx/ol_tx_send.c

+ 5 - 0
core/dp/txrx/ol_tx_send.c

@@ -833,6 +833,11 @@ void ol_tx_desc_update_group_credit(ol_txrx_pdev_handle pdev,
 	uint16_t vdev_id_mask;
 	struct ol_tx_desc_t *tx_desc;
 
+	if (tx_desc_id >= pdev->tx_desc.pool_size) {
+		qdf_print("%s: Invalid desc id", __func__);
+		return;
+	}
+
 	tx_desc = ol_tx_desc_find(pdev, tx_desc_id);
 	for (i = 0; i < OL_TX_MAX_TXQ_GROUPS; i++) {
 		vdev_id_mask =