Преглед на файлове

qcacld-3.0: Fix possible OOB issue in ol_tx_desc_update_group_credit

Currently tx desc id is extracted from HTT message and it is used
without check. This may cause possible OOB array read. To address
this add check for valid tx desc id.

Change-Id: I121fc4d550aa587f00ec315e3a20dfb136f4d7af
CRs-Fixed: 2225461
Sravan Kumar Kairam преди 7 години
родител
ревизия
2be2792e2e
променени са 1 файла, в които са добавени 5 реда и са изтрити 0 реда
  1. 5 0
      core/dp/txrx/ol_tx_send.c

+ 5 - 0
core/dp/txrx/ol_tx_send.c

@@ -833,6 +833,11 @@ void ol_tx_desc_update_group_credit(ol_txrx_pdev_handle pdev,
 	uint16_t vdev_id_mask;
 	struct ol_tx_desc_t *tx_desc;
 
+	if (tx_desc_id >= pdev->tx_desc.pool_size) {
+		qdf_print("%s: Invalid desc id", __func__);
+		return;
+	}
+
 	tx_desc = ol_tx_desc_find(pdev, tx_desc_id);
 	for (i = 0; i < OL_TX_MAX_TXQ_GROUPS; i++) {
 		vdev_id_mask =