diff options
| author | Deepak Dhamdhere <ddhamdhe@codeaurora.org> | 2017-07-20 23:40:36 -0700 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-08-13 15:47:50 -0700 |
| commit | 8ce461fa858697a61b81bced7cb55aa2e123120e (patch) | |
| tree | a16e88a91d7a6ca88c25e28b751f51d86dbe6784 | |
| parent | 1e719c56cd4660231452199310b6d9cce62feef8 (diff) | |
qcacld-3.0: Check for invalid staId during ll stats clear
WMI_CLEAR_LINK_STATS_CMDID can cause firmware crash if vdev_id is invalid.
Add staId, i.e. vdev_id checks to sme_ll_stats_clear_req() and
wma_process_ll_stats_clear_req().
CRs-Fixed: 2078391
Change-Id: Ic713b17aebeb89bc0ab69c2e4040d9018d3dc095
| -rw-r--r-- | core/sme/src/common/sme_api.c | 6 | ||||
| -rw-r--r-- | core/wma/src/wma_utils.c | 6 |
2 files changed, 12 insertions, 0 deletions
diff --git a/core/sme/src/common/sme_api.c b/core/sme/src/common/sme_api.c index de4ce76edcc3..12b75df721f6 100644 --- a/core/sme/src/common/sme_api.c +++ b/core/sme/src/common/sme_api.c @@ -14127,6 +14127,12 @@ QDF_STATUS sme_ll_stats_clear_req(tHalHandle hHal, pclearStatsReq->statsClearReqMask); QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_DEBUG, "stopReq = %u", pclearStatsReq->stopReq); + if (!sme_is_session_id_valid(hHal, pclearStatsReq->staId)) { + QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR, + "%s: invalid staId %d", + __func__, pclearStatsReq->staId); + return QDF_STATUS_E_INVAL; + } clear_stats_req = qdf_mem_malloc(sizeof(*clear_stats_req)); diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c index 3a973673290b..587dac35941b 100644 --- a/core/wma/src/wma_utils.c +++ b/core/wma/src/wma_utils.c @@ -1837,6 +1837,12 @@ QDF_STATUS wma_process_ll_stats_clear_req(tp_wma_handle wma, return QDF_STATUS_E_FAILURE; } + if (!wma->interfaces[clearReq->staId].handle) { + WMA_LOGE("%s: vdev_id %d handle is NULL", + __func__, clearReq->staId); + return QDF_STATUS_E_FAILURE; + } + cmd.stop_req = clearReq->stopReq; cmd.sta_id = clearReq->staId; cmd.stats_clear_mask = clearReq->statsClearReqMask; |