samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Fix potential out of memory access

Browse Source 
Limit num_chan to be less than WLAN_MAX_LOGGING_FREQ
and NUM_CHANNELS to fix potential out of memory access.

Change-Id: I5e0bcd449a738fa416daeaebaeafbd2ec11913ba
CRs-Fixed: 3405136
This commit is contained in:
Liangwei Dong
2023-02-14 09:38:03 +08:00
committed by Madan Koyyalamudi
parent 57a94e3cdd
commit a60bf20c33
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
components/umac/mlme/connection_mgr/core/src/wlan_cm_roam_offload.c
View File

@@ -5872,6 +5872,10 @@ void cm_roam_scan_info_event(struct wlan_objmgr_psoc *psoc,
status = mlme_get_fw_scan_channels(psoc, chan_freq, &num_chan); status = mlme_get_fw_scan_channels(psoc, chan_freq, &num_chan);
if (QDF_IS_STATUS_ERROR(status)) if (QDF_IS_STATUS_ERROR(status))
goto out; goto out;
if (num_chan > NUM_CHANNELS) {
mlme_err("unexpected num chan %d", num_chan);
goto out;
}
status = wlan_mlme_get_band_capability(psoc, &band_capability); status = wlan_mlme_get_band_capability(psoc, &band_capability);
if (QDF_IS_STATUS_ERROR(status)) if (QDF_IS_STATUS_ERROR(status))
@@ -5881,8 +5885,7 @@ void cm_roam_scan_info_event(struct wlan_objmgr_psoc *psoc,
policy_mgr_get_connected_roaming_vdev_band_mask(psoc, policy_mgr_get_connected_roaming_vdev_band_mask(psoc,
vdev_id); vdev_id);
if (num_chan > WLAN_MAX_LOGGING_FREQ) num_chan = QDF_MIN(WLAN_MAX_LOGGING_FREQ, NUM_CHANNELS);
num_chan = WLAN_MAX_LOGGING_FREQ;
for (i = 0; i < num_chan; i++) { for (i = 0; i < num_chan; i++) {
if (!wlan_is_valid_frequency(chan_freq[i], if (!wlan_is_valid_frequency(chan_freq[i],