diff options
| author | CNSS_WLAN Service <cnssbldsw@qualcomm.com> | 2018-02-13 09:47:58 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-02-13 16:13:43 -0800 |
| commit | 14ccebbaf11f6a6f9c09e75f2e6334cfd0bd8928 (patch) | |
| tree | 99cfb9c823a4458679531c4c38d823e0d1cab071 | |
| parent | 4e820436ce24e34e7cb3cb704f960edc0cb57582 (diff) | |
| parent | 05c729386d06139b3265fae95dac5e48495ff9d5 (diff) | |
Merge "qcacld-2.0: Fix buffer overflow in ol_tx_inspect_handler" into wlan-cld2.driver.lnx.1.0
| -rw-r--r-- | CORE/CLD_TXRX/TXRX/ol_tx_send.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/CORE/CLD_TXRX/TXRX/ol_tx_send.c b/CORE/CLD_TXRX/TXRX/ol_tx_send.c index dd5cff498af3..bc6120b6749a 100644 --- a/CORE/CLD_TXRX/TXRX/ol_tx_send.c +++ b/CORE/CLD_TXRX/TXRX/ol_tx_send.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved. + * Copyright (c) 2011-2018 The Linux Foundation. All rights reserved. * * Previously licensed under the ISC license by Qualcomm Atheros, Inc. * @@ -710,7 +710,14 @@ ol_tx_completion_handler( trace_str = (status) ? "OT:C:F:" : "OT:C:S:"; for (i = 0; i < num_msdus; i++) { tx_desc_id = desc_ids[i]; + if (tx_desc_id >= pdev->tx_desc.pool_size) { + TXRX_PRINT(TXRX_PRINT_LEVEL_WARN, + "%s: drop due to invalid msdu id = %x\n", + __func__, tx_desc_id); + continue; + } tx_desc = ol_tx_desc_find(pdev, tx_desc_id); + adf_os_assert(tx_desc); tx_desc->status = status; netbuf = tx_desc->netbuf; @@ -991,7 +998,14 @@ ol_tx_inspect_handler( for (i = 0; i < num_msdus; i++) { tx_desc_id = desc_ids[i]; + if (tx_desc_id >= pdev->tx_desc.pool_size) { + TXRX_PRINT(TXRX_PRINT_LEVEL_WARN, + "%s: drop due to invalid msdu id = %x\n", + __func__, tx_desc_id); + continue; + } tx_desc = ol_tx_desc_find(pdev, tx_desc_id); + adf_os_assert(tx_desc); netbuf = tx_desc->netbuf; /* find the "vdev" this tx_desc belongs to */ |