diff options
| author | SaidiReddy Yenuga <saidir@codeaurora.org> | 2016-11-03 15:54:16 +0530 |
|---|---|---|
| committer | Anjaneedevi Kapparapu <akappa@codeaurora.org> | 2016-11-11 19:59:38 +0530 |
| commit | 641da0f2c6c8ab6c1909dd0b36a3b2ddcb1a8bd5 (patch) | |
| tree | cf7c6d6cb3fe5ff13ca6e2dedccb517178fd505a | |
| parent | 92fcc07c5ebd84509ebdd14eb3455fa348feca15 (diff) | |
qcacld-2.0: Fix untrusted pointer dereference in hdd driver command
In hdd_driver_command API user space pointer priv_data.buf
dereferenced without sanitization in GETOPPORTUNISTICRSSIDIFF
and GETROAMRESCANRSSIDIFF cases.
Use kernel space pointer command instead of priv_data.buf
CRs-Fixed: 1074779
Change-Id: Ifddb01bdee501bf467d62b81a987fb9d29b44691
| -rw-r--r-- | CORE/HDD/src/wlan_hdd_main.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c index 1e58d4978011..9a1922bd851c 100644 --- a/CORE/HDD/src/wlan_hdd_main.c +++ b/CORE/HDD/src/wlan_hdd_main.c @@ -6455,7 +6455,7 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter, pAdapter->sessionId, nOpportunisticThresholdDiff); } - else if (strncmp(priv_data.buf, "GETOPPORTUNISTICRSSIDIFF", 24) == 0) + else if (strncmp(command, "GETOPPORTUNISTICRSSIDIFF", 24) == 0) { tANI_S8 val = sme_GetRoamOpportunisticScanThresholdDiff( pHddCtx->hHal); @@ -6498,7 +6498,7 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter, pAdapter->sessionId, nRoamRescanRssiDiff); } - else if (strncmp(priv_data.buf, "GETROAMRESCANRSSIDIFF", 21) == 0) + else if (strncmp(command, "GETROAMRESCANRSSIDIFF", 21) == 0) { tANI_U8 val = sme_GetRoamRescanRssiDiff(pHddCtx->hHal); char extra[32]; |