Browse Source

qcacmn: Avoid scatter buffer from going out of bounds

Check to prevent scatter buffer overflow, limit to
MAX_IDLE_SCATTER_BUFS.

Change-Id: I8092e250eeafb22c1ff4f609e495345a4f31426a
CRs-Fixed: 2213708
Shaakir Mohamed 7 years ago
parent
commit
41323bb65c
1 changed files with 9 additions and 2 deletions
  1. 9 2
      dp/wifi3.0/dp_main.c

+ 9 - 2
dp/wifi3.0/dp_main.c

@@ -1505,14 +1505,21 @@ static int dp_hw_link_desc_pool_setup(struct dp_soc *soc)
 					soc->hal_soc, total_mem_size,
 					soc->wbm_idle_scatter_buf_size);
 
+		if (num_scatter_bufs > MAX_IDLE_SCATTER_BUFS) {
+			QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
+					FL("scatter bufs size out of bounds"));
+			goto fail;
+		}
+
 		for (i = 0; i < num_scatter_bufs; i++) {
 			soc->wbm_idle_scatter_buf_base_vaddr[i] =
-				qdf_mem_alloc_consistent(soc->osdev, soc->osdev->dev,
+				qdf_mem_alloc_consistent(soc->osdev,
+							soc->osdev->dev,
 				soc->wbm_idle_scatter_buf_size,
 				&(soc->wbm_idle_scatter_buf_base_paddr[i]));
 			if (soc->wbm_idle_scatter_buf_base_vaddr[i] == NULL) {
 				QDF_TRACE(QDF_MODULE_ID_DP,
-					QDF_TRACE_LEVEL_ERROR,
+						QDF_TRACE_LEVEL_ERROR,
 					FL("Scatter list memory alloc failed"));
 				goto fail;
 			}