samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Validate APF memory offset in APF offload vendor command

Browse Source 
Currently, APF memory offset is sent to the firmware without validation.
This may cause out of bound memory access in the firmware.

To avoid this, validate apf memory offset with MAX_APF_MEMORY_LEN in
the driver.

Change-Id: I5657f570a820b73b9e07a6fb1ce54807156def24
CRs-Fixed: 2711515
This commit is contained in:
Bapiraju Alla
2020-06-16 17:06:33 +05:30
committed by nshrivas
parent 7570e758de
commit 746366c3ee
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
core/hdd/src/wlan_hdd_apf.c
View File

@@ -508,6 +508,11 @@ static int hdd_apf_read_memory(struct hdd_adapter *adapter, struct nlattr **tb)
return -EINVAL; return -EINVAL;
} }
read_mem_params.addr_offset = nla_get_u32(tb[APF_CURRENT_OFFSET]); read_mem_params.addr_offset = nla_get_u32(tb[APF_CURRENT_OFFSET]);
if (read_mem_params.addr_offset > MAX_APF_MEMORY_LEN) {
hdd_err("attr apf memory offset should be less than %d",
MAX_APF_MEMORY_LEN);
return -EINVAL;
}
/* Read length */ /* Read length */
if (!tb[APF_PACKET_SIZE]) { if (!tb[APF_PACKET_SIZE]) {