qcacld-3.0: Avoid possible OOB access in set trace level
In QCA_NL80211_VENDOR_SUBCMD_SET_TRACE_LEVEL command handler when nested attributes are getting parsed no NLA policy is used, as no NLA policy is defined for MODULE_ID and TRACE_MASK, these attributes will be treated as NLA_UNSPEC types and can have a length of zero bytes. Later when these attributes are accessed using nla_get_u32() this will result in OOB read. Change-Id: I7d4913feccb00877ac5f40bab8ff5e9e3891756f CRs-Fixed: 2410900
This commit is contained in:

gecommit door
nshrivas

bovenliggende
1d28d35436
commit
69903257ef
@@ -11144,8 +11144,9 @@ __wlan_hdd_cfg80211_set_trace_level(struct wiphy *wiphy,
|
||||
nla_for_each_nested(apth,
|
||||
tb1[QCA_WLAN_VENDOR_ATTR_SET_TRACE_LEVEL_PARAM], rem) {
|
||||
if (wlan_cfg80211_nla_parse(tb2,
|
||||
QCA_WLAN_VENDOR_ATTR_SET_TRACE_LEVEL_MAX,
|
||||
nla_data(apth), nla_len(apth), NULL)) {
|
||||
QCA_WLAN_VENDOR_ATTR_SET_TRACE_LEVEL_MAX,
|
||||
nla_data(apth), nla_len(apth),
|
||||
qca_wlan_vendor_set_trace_level_policy)) {
|
||||
hdd_err("Invalid attr");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
Verwijs in nieuw issue
Block a user