ソースを参照

qcacmn: Fix KW issue in the regulatory component

In  I3c82e2eb98cdaf0ff8754bd990529a1833276304, KW error is reported in
the function, reg_compute_chan_to_freq.

This is because min_chan_range and max_chan_range can be assigned values,
that can cause array out of bounds issue.

To fix the issue, add explicit range checks against min_chan_range and
max_chang_range before iterating through master_chan_list to
avoid out of bound access.

Change-Id: Id5cd032fb899475720080b29012a6de1b5d4a916
CRs-Fixed: 2727082
Hariharan Basuthkar 5 年 前
コミット
ae92ea605f

+ 5 - 0
umac/regulatory/core/src/reg_services_common.c

@@ -1753,6 +1753,11 @@ static uint16_t reg_compute_chan_to_freq(struct wlan_objmgr_pdev *pdev,
 		return 0;
 	}
 
+	if (min_chan_range < MIN_CHANNEL || max_chan_range > MAX_CHANNEL) {
+		reg_err_rl("Channel range is invalid");
+		return 0;
+	}
+
 	chan_list = pdev_priv_obj->mas_chan_list;
 
 	for (count = min_chan_range; count <= max_chan_range; count++) {

+ 3 - 0
umac/regulatory/dispatcher/inc/reg_services_public_struct.h

@@ -438,6 +438,9 @@ enum channel_enum {
 
 	NUM_CHANNELS,
 
+	MIN_CHANNEL = CHAN_ENUM_2412,
+	MAX_CHANNEL = (NUM_CHANNELS - 1),
+
 	MIN_24GHZ_CHANNEL = CHAN_ENUM_2412,
 	MAX_24GHZ_CHANNEL = CHAN_ENUM_2484,
 	NUM_24GHZ_CHANNELS = (MAX_24GHZ_CHANNEL - MIN_24GHZ_CHANNEL + 1),