瀏覽代碼

qcacld-3.0: Prevent memory issue with more check

Add session_id range check etc

Change-Id: I749076a5f060873702b42ac4908e3220e805c349
CRs-Fixed: 2061117
Zhu Jianmin 7 年之前
父節點
當前提交
ded9d2dc57
共有 2 個文件被更改,包括 7 次插入3 次删除
  1. 2 2
      core/hdd/src/wlan_hdd_hostapd.c
  2. 5 1
      core/hdd/src/wlan_hdd_ipa.c

+ 2 - 2
core/hdd/src/wlan_hdd_hostapd.c

@@ -7011,8 +7011,8 @@ int wlan_hdd_cfg80211_update_apies(hdd_adapter_t *adapter)
 	proberesp_ies = qdf_mem_malloc(beacon->proberesp_ies_len +
 				      MAX_GENIE_LEN);
 	if (proberesp_ies == NULL) {
-		hdd_err("mem alloc failed for probe resp ies %d",
-			proberesp_ies_len);
+		hdd_err("mem alloc failed for probe resp ies, size: %d",
+			beacon->proberesp_ies_len + MAX_GENIE_LEN);
 		ret = -EINVAL;
 		goto done;
 	}

+ 5 - 1
core/hdd/src/wlan_hdd_ipa.c

@@ -2641,7 +2641,11 @@ static void hdd_ipa_uc_offload_enable_disable(hdd_adapter_t *adapter,
 			    "Interface context is NULL");
 		return;
 	}
-
+	if (session_id >= CSR_ROAM_SESSION_MAX) {
+		HDD_IPA_LOG(QDF_TRACE_LEVEL_ERROR,
+			    "invalid session id: %d", session_id);
+		return;
+	}
 	if (enable == hdd_ipa->vdev_offload_enabled[session_id]) {
 		/* IPA offload status is already set as desired */
 		HDD_IPA_LOG(QDF_TRACE_LEVEL_ERROR,