diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2018-02-13 16:10:30 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-02-13 16:10:30 -0800 |
| commit | 4e820436ce24e34e7cb3cb704f960edc0cb57582 (patch) | |
| tree | 184a54a62b711cb742ddfb83143f81fc8aac173c | |
| parent | 8d381cb64fb84963dff2d27cb0688606d873a56b (diff) | |
| parent | cd25c87a9cc2be37b8b3b5368778ecffd13f8c5a (diff) | |
Merge "qcacld-2.0: Fix potential buffer overflow htt_t2h_msg_handler"
| -rw-r--r-- | CORE/CLD_TXRX/TXRX/ol_rx_defrag.c | 8 | ||||
| -rw-r--r-- | CORE/CLD_TXRX/TXRX/ol_rx_reorder.c | 9 |
2 files changed, 15 insertions, 2 deletions
diff --git a/CORE/CLD_TXRX/TXRX/ol_rx_defrag.c b/CORE/CLD_TXRX/TXRX/ol_rx_defrag.c index a51eb75b79ed..29fc139bde24 100644 --- a/CORE/CLD_TXRX/TXRX/ol_rx_defrag.c +++ b/CORE/CLD_TXRX/TXRX/ol_rx_defrag.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2011-2014, 2016-2017 The Linux Foundation. All rights reserved. + * Copyright (c) 2011-2014, 2016-2018 The Linux Foundation. All rights reserved. * * Previously licensed under the ISC license by Qualcomm Atheros, Inc. * @@ -490,6 +490,12 @@ ol_rx_defrag_waitlist_flush( } tid = rx_reorder->tid; + if (tid >= OL_TXRX_NUM_EXT_TIDS) { + TXRX_PRINT(TXRX_PRINT_LEVEL_ERR, + "%s: invalid tid, %u\n", __func__, tid); + WARN_ON(1); + continue; + } /* get index 0 of the rx_reorder array */ rx_reorder_base = rx_reorder - tid; peer = container_of(rx_reorder_base, struct ol_txrx_peer_t, tids_rx_reorder[0]); diff --git a/CORE/CLD_TXRX/TXRX/ol_rx_reorder.c b/CORE/CLD_TXRX/TXRX/ol_rx_reorder.c index 137549872bf5..0e9928a332b1 100644 --- a/CORE/CLD_TXRX/TXRX/ol_rx_reorder.c +++ b/CORE/CLD_TXRX/TXRX/ol_rx_reorder.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved. + * Copyright (c) 2011-2018 The Linux Foundation. All rights reserved. * * Previously licensed under the ISC license by Qualcomm Atheros, Inc. * @@ -556,6 +556,13 @@ ol_rx_addba_handler( struct ol_txrx_peer_t *peer; struct ol_rx_reorder_t *rx_reorder; + if (tid >= OL_TXRX_NUM_EXT_TIDS) { + TXRX_PRINT(TXRX_PRINT_LEVEL_ERR, + "%s: invalid tid, %u\n", __func__, tid); + WARN_ON(1); + return; + } + peer = ol_txrx_peer_find_by_id(pdev, peer_id); if (peer == NULL) { return; |