samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Sanitize Rx buffer length received from H.W

Browse Source 
Check if Rx single msdu length including padding and tlvs length
is greater than Rx buffer size allocated to H.W and raise error
to catch out of bound access.

Change-Id: I7c70b8a0b6828f7fd88a19141f9087430085c13a
CRs-Fixed: 2873933
This commit is contained in:
Karthik Kantamneni
2021-02-26 00:10:45 +05:30
committed by snandini
parent bbccf20880
commit f5fe106f3f
1 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
dp/wifi3.0/dp_rx.c
View File

@@ -1917,6 +1917,25 @@ QDF_STATUS dp_rx_desc_nbuf_sanity_check(hal_ring_desc_t ring_desc,
return QDF_STATUS_E_FAILURE; return QDF_STATUS_E_FAILURE;
} }
/**
* dp_rx_desc_nbuf_len_sanity_check - Add sanity check to catch Rx buffer
* out of bound access from H.W
*
* @soc: DP soc
* @pkt_len: Packet length received from H.W
*
* Return: NONE
*/
static inline void
dp_rx_desc_nbuf_len_sanity_check(struct dp_soc *soc,
uint32_t pkt_len)
{
struct rx_desc_pool *rx_desc_pool;
rx_desc_pool = &soc->rx_desc_buf[0];
qdf_assert_always(pkt_len < rx_desc_pool->buf_size);
}
#else #else
static inline static inline
QDF_STATUS dp_rx_desc_nbuf_sanity_check(hal_ring_desc_t ring_desc, QDF_STATUS dp_rx_desc_nbuf_sanity_check(hal_ring_desc_t ring_desc,
@@ -1924,6 +1943,9 @@ QDF_STATUS dp_rx_desc_nbuf_sanity_check(hal_ring_desc_t ring_desc,
{ {
return QDF_STATUS_SUCCESS; return QDF_STATUS_SUCCESS;
} }
static inline void
dp_rx_desc_nbuf_len_sanity_check(struct dp_soc *soc, uint32_t pkt_len) { }
#endif #endif
#ifdef WLAN_FEATURE_RX_SOFTIRQ_TIME_LIMIT #ifdef WLAN_FEATURE_RX_SOFTIRQ_TIME_LIMIT
@@ -2801,6 +2823,8 @@ done:
msdu_metadata.l3_hdr_pad + msdu_metadata.l3_hdr_pad +
RX_PKT_TLVS_LEN; RX_PKT_TLVS_LEN;
dp_rx_desc_nbuf_len_sanity_check(soc, pkt_len);
qdf_nbuf_set_pktlen(nbuf, pkt_len); qdf_nbuf_set_pktlen(nbuf, pkt_len);
dp_rx_skip_tlvs(nbuf, msdu_metadata.l3_hdr_pad); dp_rx_skip_tlvs(nbuf, msdu_metadata.l3_hdr_pad);
} }