qcacld-3.0: Use NLA_EXACT_LEN instead of NLA_UNSPEC in new kernels

The change If6d559a3aa7b8719a515e00e271e313c02f8135f has modified
few attribute types from NLA_UNSPEC to NLA_BINARY. But NLA_BINARY
validates only for max length and doesn't validate min length.
This could cause buffer overread if userspace sends less data as
the driver reads fixed length(e.g. 6 bytes for mac_addr) always.
Use VENDOR_NLA_POLICY_MAC_ADDR(NLA_POLICY_ETH_ADDR) or
NLA_EXACT_LEN instead of NLA_UNSPEC which validates for
exact length.

Change-Id: I92cc29716dff29037d14ffd2e269761149c7f74b
CRs-Fixed: 2700695
此提交包含在:
Srinivas Dasari
2020-06-02 18:32:28 +05:30
提交者 nshrivas
父節點 61547b7304
當前提交 6f6a3e666d
共有 7 個檔案被更改,包括 27 行新增42 行删除

查看文件

@@ -83,10 +83,8 @@ const struct nla_policy vendor_attr_policy[
.type = NLA_U32,
.len = sizeof(uint32_t)
},
[QCA_WLAN_VENDOR_ATTR_NDP_PEER_DISCOVERY_MAC_ADDR] = {
.type = NLA_BINARY,
.len = QDF_MAC_ADDR_SIZE
},
[QCA_WLAN_VENDOR_ATTR_NDP_PEER_DISCOVERY_MAC_ADDR] =
VENDOR_NLA_POLICY_MAC_ADDR,
[QCA_WLAN_VENDOR_ATTR_NDP_CONFIG_SECURITY] = {
.type = NLA_U16,
.len = sizeof(uint16_t)
@@ -156,7 +154,7 @@ const struct nla_policy vendor_attr_policy[
.len = sizeof(uint32_t)
},
[QCA_WLAN_VENDOR_ATTR_NDP_IPV6_ADDR] = {
.type = NLA_BINARY,
.type = NLA_EXACT_LEN,
.len = QDF_IPV6_ADDR_SIZE
},
[QCA_WLAN_VENDOR_ATTR_NDP_TRANSPORT_PORT] = {