samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Fix OOB read in sme_rrm_process_beacon_report_req_ind

Browse Source 
When beacon report request action frame is received,
rrm_process_beacon_report_req() is called and num_channels value
is calculated from the action frame directly from user. This
value is assigned to pSmeBcnReportReq->channelList.numChannels
and this num channels value along with the channel list is
posted to sme for further processing. The sme function
sme_rrm_process_beacon_report_req_ind() processes this sme
message eWNI_SME_BEACON_REPORT_REQ_IND. In this function,
the channels in channel list are looped through the received
value pBeaconReq->channelList.numChannels and is copied to the
destination pSmeRrmContext->channelList array from the
pBeaconReq->channelList.channelNumber[] array.
The maximum possible number of channels in channel list
BeaconReq->channelList.channelNumber[] allocated statically
in the definition of tSirChannelList is
SIR_ESE_MAX_MEAS_IE_REQS (8).
So when the pBeaconReq->channelList.numChannels, possible OOB
read occurs.

Validate the value of pBeaconReq->channelList.numChannels
received from the action frame against the maximum supported
number of channels in channel list SIR_ESE_MAX_MEAS_IE_REQS (8).
Place this validation inside the function
sme_rrm_process_beacon_report_req_ind() instead of validating it
at rrm_process_beacon_report_req() so that it defends from other
caller sme_set_ese_beacon_request() which is from user space
command through IOCTL.

Change-Id: I2074b04081328ceab7eeb29c33631a635e9d93c3
CRs-Fixed: 2335974
This commit is contained in:
Pragaspathi Thilagaraj
2018-10-25 19:02:30 +05:30
committed by nshrivas
parent 04c779f53b
commit cc823ae0cf
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
core/sme/src/rrm/sme_rrm.c
View File

@@ -922,6 +922,14 @@ QDF_STATUS sme_rrm_process_beacon_report_req_ind(tpAniSirGlobal pMac,
sme_debug("Received Beacon report request ind Channel = %d",
pBeaconReq->channelInfo.channelNum);
if (pBeaconReq->channelList.numChannels >
SIR_ESE_MAX_MEAS_IE_REQS) {
sme_err("Beacon report request numChannels:%u exceeds max num channels",
pBeaconReq->channelList.numChannels);
return QDF_STATUS_E_INVAL;
}
/* section 11.10.8.1 (IEEE Std 802.11k-2008) */
/* channel 0 and 255 has special meaning. */
if ((pBeaconReq->channelInfo.channelNum == 0) ||