diff options
| author | Srinivas Girigowda <sgirigow@codeaurora.org> | 2016-12-07 14:35:39 -0800 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2017-01-21 02:56:03 -0800 |
| commit | 7cefd06f5b546c720e9ca4bdf318e22ef7c1b7d6 (patch) | |
| tree | 710d0644abfff99ab59b0d56003abda839f81503 | |
| parent | 7849878f7ee893a20f41dbd9bbc0c41f1a7bab6e (diff) | |
qcacld-3.0: Avoid overflow of "set_bssid_hotlist" params
This is a qcacld-2.0 to qcacld-3.0 propagation.
The wlan driver supports the following vendor command:
QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_BSSID_HOTLIST
This command supplies a "number of APs" attribute as well as a list of
per-AP attributes. However there is no validation that the number of
APs provided won't overflow the destination buffer. In addition there
is no validation that the number of APs actually provided matches the
number of APs expected.
To address these issues:
* Verify that the expected number of APs doesn't exceed the maximum
allowed number of APs
* Verify that the actual number of APs supplied doesn't exceed the
expected number of APs
* Only process the actual number of supplied APs if it is less than
the expected number of APs.
Change-Id: I41e36d11bc3e71928866a27afc2fbf046b59f0f5
CRs-Fixed: 1095770
| -rw-r--r-- | core/hdd/src/wlan_hdd_ext_scan.c | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/core/hdd/src/wlan_hdd_ext_scan.c b/core/hdd/src/wlan_hdd_ext_scan.c index 2c2b4e7afbc6..b0006f43c11c 100644 --- a/core/hdd/src/wlan_hdd_ext_scan.c +++ b/core/hdd/src/wlan_hdd_ext_scan.c @@ -1938,6 +1938,11 @@ __wlan_hdd_cfg80211_extscan_set_bssid_hotlist(struct wiphy *wiphy, pReqMsg->numAp = nla_get_u32(tb [QCA_WLAN_VENDOR_ATTR_EXTSCAN_BSSID_HOTLIST_PARAMS_NUM_AP]); + if (pReqMsg->numAp > WLAN_EXTSCAN_MAX_HOTLIST_APS) { + hdd_err("Number of AP: %u exceeds max: %u", + pReqMsg->numAp, WLAN_EXTSCAN_MAX_HOTLIST_APS); + goto fail; + } pReqMsg->sessionId = pAdapter->sessionId; hdd_notice("Number of AP %d Session Id %d", pReqMsg->numAp, pReqMsg->sessionId); @@ -1957,6 +1962,11 @@ __wlan_hdd_cfg80211_extscan_set_bssid_hotlist(struct wiphy *wiphy, nla_for_each_nested(apTh, tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM], rem) { + if (i == pReqMsg->numAp) { + hdd_warn("Ignoring excess AP"); + break; + } + if (nla_parse (tb2, QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX, nla_data(apTh), nla_len(apTh), @@ -2002,6 +2012,12 @@ __wlan_hdd_cfg80211_extscan_set_bssid_hotlist(struct wiphy *wiphy, i++; } + if (i < pReqMsg->numAp) { + hdd_warn("Number of AP %u less than expected %u", + i, pReqMsg->numAp); + pReqMsg->numAp = i; + } + context = &ext_scan_context; spin_lock(&context->context_lock); INIT_COMPLETION(context->response_event); |