瀏覽代碼

qcacld-3.0: Reject any invalid MAC address from mac.bin

If driver gets all 0s as MAC address from mac.bin, it considers
this as valid address and proceed to derive remaining addresses.
this zero MAC is assigned to any of the interface resulting in
undefined behaviour.

To resolve this issue, validate all the MAC addresses provided by
mac.bin and reject all the addresses if any of the MAC is invalid.

Change-Id: Ia1db8249dd4ca58612b6f9eae5903bc809fed493
CRs-Fixed: 2333912
Ashish Kumar Dhanotiya 6 年之前
父節點
當前提交
a6a4f5e444
共有 1 個文件被更改,包括 15 次插入5 次删除
  1. 15 5
      core/hdd/src/wlan_hdd_cfg.c

+ 15 - 5
core/hdd/src/wlan_hdd_cfg.c

@@ -2755,14 +2755,16 @@ static int parse_hex_digit(char c)
  *
  *
  * 00AA00BB00CC -> 0x00 0xAA 0x00 0xBB 0x00 0xCC
  * 00AA00BB00CC -> 0x00 0xAA 0x00 0xBB 0x00 0xCC
  *
  *
- * Return: None
+ * Return: QDF_STATUS
  */
  */
-static void update_mac_from_string(struct hdd_context *hdd_ctx,
-				   struct hdd_cfg_entry *macTable, int num)
+static QDF_STATUS update_mac_from_string(struct hdd_context *hdd_ctx,
+					 struct hdd_cfg_entry *macTable,
+					 int num)
 {
 {
 	int i = 0, j = 0, res = 0;
 	int i = 0, j = 0, res = 0;
 	char *candidate = NULL;
 	char *candidate = NULL;
 	struct qdf_mac_addr macaddr[QDF_MAX_CONCURRENCY_PERSONA];
 	struct qdf_mac_addr macaddr[QDF_MAX_CONCURRENCY_PERSONA];
+	QDF_STATUS status = QDF_STATUS_SUCCESS;
 
 
 	memset(macaddr, 0, sizeof(macaddr));
 	memset(macaddr, 0, sizeof(macaddr));
 
 
@@ -2780,8 +2782,12 @@ static void update_mac_from_string(struct hdd_context *hdd_ctx,
 				     intfMacAddr[i].bytes[0],
 				     intfMacAddr[i].bytes[0],
 				     (uint8_t *) &macaddr[i].bytes[0],
 				     (uint8_t *) &macaddr[i].bytes[0],
 				     QDF_MAC_ADDR_SIZE);
 				     QDF_MAC_ADDR_SIZE);
+		} else {
+			status = QDF_STATUS_E_FAILURE;
+			break;
 		}
 		}
 	}
 	}
+	return status;
 }
 }
 
 
 /**
 /**
@@ -3346,7 +3352,7 @@ QDF_STATUS hdd_update_mac_config(struct hdd_context *hdd_ctx)
 		buffer = line;
 		buffer = line;
 	}
 	}
 
 
-	if (i <= QDF_MAX_CONCURRENCY_PERSONA) {
+	if (i != 0 && i <= QDF_MAX_CONCURRENCY_PERSONA) {
 		hdd_debug("%d Mac addresses provided", i);
 		hdd_debug("%d Mac addresses provided", i);
 	} else {
 	} else {
 		hdd_err("invalid number of Mac address provided, nMac = %d", i);
 		hdd_err("invalid number of Mac address provided, nMac = %d", i);
@@ -3354,7 +3360,11 @@ QDF_STATUS hdd_update_mac_config(struct hdd_context *hdd_ctx)
 		goto config_exit;
 		goto config_exit;
 	}
 	}
 
 
-	update_mac_from_string(hdd_ctx, &macTable[0], i);
+	qdf_status = update_mac_from_string(hdd_ctx, &macTable[0], i);
+	if (QDF_IS_STATUS_ERROR(qdf_status)) {
+		hdd_err("Invalid MAC addresses provided");
+		goto config_exit;
+	}
 	hdd_debug("Populating remaining %d Mac addresses",
 	hdd_debug("Populating remaining %d Mac addresses",
 		   max_mac_addr - i);
 		   max_mac_addr - i);
 	hdd_populate_random_mac_addr(hdd_ctx, max_mac_addr - i);
 	hdd_populate_random_mac_addr(hdd_ctx, max_mac_addr - i);