diff options
| author | Jeff Johnson <jjohnson@codeaurora.org> | 2017-09-18 07:20:41 -0700 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-09-18 19:57:08 -0700 |
| commit | 200be55529323529678173eff54b3a7db7576859 (patch) | |
| tree | e6ad5b97b49f2bdc5c4d49d7220544718108eeaf | |
| parent | c6dec2ff0cf9bc101d657b861bad360b58105706 (diff) | |
qcacld-3.0: Avoid NULL pointer dereference in nl_srv
Currently nl_srv_bcast() and nl_srv_ucast() allocate a temporary
buffer to hold the netlink message which is subsequently sent to
userspace. The value returned by qdf_mem_malloc() is not checked for
NULL, and hence if NULL is returned it will be dereferenced.
However in reality a temporary buffer is not required. Update the
functions to directly send the message from the skb.
Change-Id: Ia12e1695498323c4e29b8280b9265c20393a2fe7
CRs-Fixed: 2111297
| -rw-r--r-- | core/utils/nlink/src/wlan_nlink_srv.c | 14 |
1 files changed, 2 insertions, 12 deletions
diff --git a/core/utils/nlink/src/wlan_nlink_srv.c b/core/utils/nlink/src/wlan_nlink_srv.c index 2008fc5f239e..c102c8e97b8f 100644 --- a/core/utils/nlink/src/wlan_nlink_srv.c +++ b/core/utils/nlink/src/wlan_nlink_srv.c @@ -499,22 +499,17 @@ int nl_srv_bcast(struct sk_buff *skb, int mcgroup_id, int app_id) struct nlmsghdr *nlh = (struct nlmsghdr *)skb->data; void *msg = NLMSG_DATA(nlh); uint32_t msg_len = nlmsg_len(nlh); - uint8_t *tempbuf; int status; - tempbuf = (uint8_t *)qdf_mem_malloc(msg_len); - qdf_mem_copy(tempbuf, msg, msg_len); - status = send_msg_to_cld80211(mcgroup_id, 0, app_id, tempbuf, msg_len); + status = send_msg_to_cld80211(mcgroup_id, 0, app_id, msg, msg_len); if (status) { QDF_TRACE(QDF_MODULE_ID_HDD, QDF_TRACE_LEVEL_ERROR, "send msg to cld80211 fails for app id %d", app_id); dev_kfree_skb(skb); - qdf_mem_free(tempbuf); return -EPERM; } dev_kfree_skb(skb); - qdf_mem_free(tempbuf); return 0; } @@ -539,23 +534,18 @@ int nl_srv_ucast(struct sk_buff *skb, int dst_pid, int flag, struct nlmsghdr *nlh = (struct nlmsghdr *)skb->data; void *msg = NLMSG_DATA(nlh); uint32_t msg_len = nlmsg_len(nlh); - uint8_t *tempbuf; int status; - tempbuf = (uint8_t *)qdf_mem_malloc(msg_len); - qdf_mem_copy(tempbuf, msg, msg_len); status = send_msg_to_cld80211(mcgroup_id, dst_pid, app_id, - tempbuf, msg_len); + msg, msg_len); if (status) { QDF_TRACE(QDF_MODULE_ID_HDD, QDF_TRACE_LEVEL_ERROR, "send msg to cld80211 fails for app id %d", app_id); dev_kfree_skb(skb); - qdf_mem_free(tempbuf); return -EPERM; } dev_kfree_skb(skb); - qdf_mem_free(tempbuf); return 0; } #else |