Jelajahi Sumber

qcacld-3.0: vdev validation before sending unit test command

Currently, There is no check to validate vdev in function
wma_form_unit_test_cmd_and_send before sending command to
fw which may lead to fw crash due to invalid vdev id.

Fix is to add validation check for vdev before invoking
wmi_unified_unit_test_cmd and sme_send_unit_test_cmd.

Change-Id: I61db37417f05968365f210515c28eb6184279c77
CRs-Fixed: 2618295
sheenam monga 5 tahun lalu
induk
melakukan
e0e91c48d5
2 mengubah file dengan 12 tambahan dan 2 penghapusan
  1. 8 2
      core/hdd/src/wlan_hdd_wext.c
  2. 4 0
      core/wma/src/wma_main.c

+ 8 - 2
core/hdd/src/wlan_hdd_wext.c

@@ -7940,14 +7940,20 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
 
 		if ((apps_args[0] < WLAN_MODULE_ID_MIN) ||
 		    (apps_args[0] >= WLAN_MODULE_ID_MAX)) {
-			hdd_err("Invalid MODULE ID %d", apps_args[0]);
+			hdd_err_rl("Invalid MODULE ID %d", apps_args[0]);
 			return -EINVAL;
 		}
 		if ((apps_args[1] > (WMA_MAX_NUM_ARGS)) ||
 		    (apps_args[1] < 0)) {
-			hdd_err("Too Many/Few args %d", apps_args[1]);
+			hdd_err_rl("Too Many/Few args %d", apps_args[1]);
 			return -EINVAL;
 		}
+
+		if (adapter->vdev_id >= WLAN_MAX_VDEVS) {
+			hdd_err_rl("Invalid vdev id");
+			return -EINVAL;
+		}
+
 		status = sme_send_unit_test_cmd(adapter->vdev_id,
 						apps_args[0],
 						apps_args[1],

+ 4 - 0
core/wma/src/wma_main.c

@@ -620,6 +620,10 @@ QDF_STATUS wma_form_unit_test_cmd_and_send(uint32_t vdev_id,
 	QDF_STATUS status;
 
 	WMA_LOGD(FL("enter"));
+
+	if (!wma_is_vdev_valid(vdev_id))
+		return QDF_STATUS_E_FAILURE;
+
 	if (arg_count > WMA_MAX_NUM_ARGS) {
 		WMA_LOGE(FL("arg_count is crossed the boundary"));
 		return QDF_STATUS_E_FAILURE;