diff options
| author | Jeff Johnson <jjohnson@codeaurora.org> | 2017-06-01 09:06:48 -0700 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-06-08 04:40:20 -0700 |
| commit | 6cb7d2b877ab33836bde7e6e11632ffff55f2fbd (patch) | |
| tree | 842d2df9c66f55bc9b89fefbd61083f1626dfdbf | |
| parent | 9e4eb8f046854e3dd825c74b0d541b86fbdbaa2c (diff) | |
qcacld-3.0: Validate QCA_WLAN_VENDOR_ATTR_SET_SCANNING_MAC_OUI
Currently in __wlan_hdd_cfg80211_set_scanning_mac_oui() the
QCA_WLAN_VENDOR_ATTR_SET_SCANNING_MAC_OUI attribute is copied without
first performing a length check. Add a check to ensure the attribute
is of the expected length.
Change-Id: I12ee10ed5760af6e5069707ae14b26f275da1829
CRs-Fixed: 2054687
| -rw-r--r-- | core/hdd/src/wlan_hdd_cfg80211.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c index 11d119e75714..9c0b8cf84241 100644 --- a/core/hdd/src/wlan_hdd_cfg80211.c +++ b/core/hdd/src/wlan_hdd_cfg80211.c @@ -1988,6 +1988,7 @@ __wlan_hdd_cfg80211_set_scanning_mac_oui(struct wiphy *wiphy, struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_SET_SCANNING_MAC_OUI_MAX + 1]; QDF_STATUS status; int ret; + int len; struct net_device *ndev = wdev->netdev; hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(ndev); @@ -2007,6 +2008,10 @@ __wlan_hdd_cfg80211_set_scanning_mac_oui(struct wiphy *wiphy, return -ENOTSUPP; } + /* + * audit note: it is ok to pass a NULL policy here since only + * one attribute is parsed and it is explicitly validated + */ if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_SET_SCANNING_MAC_OUI_MAX, data, data_len, NULL)) { hdd_err("Invalid ATTR"); @@ -2020,10 +2025,19 @@ __wlan_hdd_cfg80211_set_scanning_mac_oui(struct wiphy *wiphy, hdd_err("qdf_mem_malloc failed"); return -ENOMEM; } + if (!tb[QCA_WLAN_VENDOR_ATTR_SET_SCANNING_MAC_OUI]) { hdd_err("attr mac oui failed"); goto fail; } + + len = nla_len(tb[QCA_WLAN_VENDOR_ATTR_SET_SCANNING_MAC_OUI]); + if (len != sizeof(pReqMsg->oui)) { + hdd_err("attr mac oui invalid size %d expected %zu", + len, sizeof(pReqMsg->oui)); + goto fail; + } + nla_memcpy(&pReqMsg->oui[0], tb[QCA_WLAN_VENDOR_ATTR_SET_SCANNING_MAC_OUI], sizeof(pReqMsg->oui)); |