Bläddra i källkod

qcacld-3.0: Fix out of bound read issue in get link properties

Propagatin from qcacld-2.0 to qcacld-3.0

Length of the MAC address is not checked which may cause out of bound
read issue.

To resolve this add a check for MAC address length.

CRs-Fixed: 2063980
Change-Id: I58454b84c28b157cef35984d612a9bc6fdd9ec56
Ashish Kumar Dhanotiya 7 år sedan
förälder
incheckning
81e2acc6c8
1 ändrade filer med 8 tillägg och 1 borttagningar
  1. 8 1
      core/hdd/src/wlan_hdd_cfg80211.c

+ 8 - 1
core/hdd/src/wlan_hdd_cfg80211.c

@@ -6780,7 +6780,8 @@ static int wlan_hdd_cfg80211_set_probable_oper_channel(struct wiphy *wiphy,
 static const struct
 nla_policy
 qca_wlan_vendor_attr_policy[QCA_WLAN_VENDOR_ATTR_MAX+1] = {
-	[QCA_WLAN_VENDOR_ATTR_MAC_ADDR] = { .type = NLA_UNSPEC },
+	[QCA_WLAN_VENDOR_ATTR_MAC_ADDR] = {
+		.type = NLA_BINARY, .len = QDF_MAC_ADDR_SIZE },
 };
 
 /**
@@ -6835,6 +6836,12 @@ static int __wlan_hdd_cfg80211_get_link_properties(struct wiphy *wiphy,
 		return -EINVAL;
 	}
 
+	if (nla_len(tb[QCA_WLAN_VENDOR_ATTR_MAC_ADDR]) < QDF_MAC_ADDR_SIZE) {
+		hdd_err("Attribute peerMac is invalid for mode=%d",
+			adapter->device_mode);
+		return -EINVAL;
+	}
+
 	qdf_mem_copy(peer_mac, nla_data(tb[QCA_WLAN_VENDOR_ATTR_MAC_ADDR]),
 		     QDF_MAC_ADDR_SIZE);
 	hdd_debug("peerMac="MAC_ADDRESS_STR" for device_mode:%d",