qcacld-3.0: Avoid buffer overread when retrieving pref freq list

Currently in __wlan_hdd_cfg80211_get_preferred_freq_list(),
nla_parse() is called to parse the command attributes without
specifying a policy. This prevents nla_parse() from doing basic
validation of the attributes, and in some circumstances could result
in a buffer overread. To avoid this issue define an appropriate policy
and use it in the invocation of nla_parse().

Change-Id: I5d90b77562adb1be0d8789f1ad320612402ba90b
CRs-Fixed: 2054742

core/hdd/src/wlan_hdd_cfg80211.c

@@ -6278,6 +6278,12 @@ static int wlan_hdd_cfg80211_set_ns_offload(struct wiphy *wiphy,
 	return ret;
 }
 
+static const struct nla_policy get_preferred_freq_list_policy
+		[QCA_WLAN_VENDOR_ATTR_GET_PREFERRED_FREQ_LIST_MAX + 1] = {
+	[QCA_WLAN_VENDOR_ATTR_GET_PREFERRED_FREQ_LIST_IFACE_TYPE] = {
+		.type = NLA_U32},
+};
+
 /** __wlan_hdd_cfg80211_get_preferred_freq_list() - get preferred frequency list
  * @wiphy: Pointer to wireless phy
  * @wdev: Pointer to wireless device
@@ -6311,7 +6317,7 @@ static int __wlan_hdd_cfg80211_get_preferred_freq_list(struct wiphy *wiphy,
 		return -EINVAL;
 
 	if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_GET_PREFERRED_FREQ_LIST_MAX,
-		      data, data_len, NULL)) {
+		      data, data_len, get_preferred_freq_list_policy)) {
 		hdd_err("Invalid ATTR");
 		return -EINVAL;
 	}