From 746366c3ee680317c16f0128463b6e7b516b4ab5 Mon Sep 17 00:00:00 2001 From: Bapiraju Alla Date: Tue, 16 Jun 2020 17:06:33 +0530 Subject: [PATCH] qcacld-3.0: Validate APF memory offset in APF offload vendor command Currently, APF memory offset is sent to the firmware without validation. This may cause out of bound memory access in the firmware. To avoid this, validate apf memory offset with MAX_APF_MEMORY_LEN in the driver. Change-Id: I5657f570a820b73b9e07a6fb1ce54807156def24 CRs-Fixed: 2711515 --- core/hdd/src/wlan_hdd_apf.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/core/hdd/src/wlan_hdd_apf.c b/core/hdd/src/wlan_hdd_apf.c index ffc3259ba7..e3cd7aeab2 100644 --- a/core/hdd/src/wlan_hdd_apf.c +++ b/core/hdd/src/wlan_hdd_apf.c @@ -508,6 +508,11 @@ static int hdd_apf_read_memory(struct hdd_adapter *adapter, struct nlattr **tb) return -EINVAL; } read_mem_params.addr_offset = nla_get_u32(tb[APF_CURRENT_OFFSET]); + if (read_mem_params.addr_offset > MAX_APF_MEMORY_LEN) { + hdd_err("attr apf memory offset should be less than %d", + MAX_APF_MEMORY_LEN); + return -EINVAL; + } /* Read length */ if (!tb[APF_PACKET_SIZE]) {