diff options
| author | Hanumanth Reddy Pothula <c_hpothu@codeaurora.org> | 2016-12-05 15:17:05 +0530 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2016-12-20 21:27:52 -0800 |
| commit | dd20cdde181ecba8aa10c4bd5b087593a17438fe (patch) | |
| tree | 3028e5c104ccfaf8cb5aaa20889ee9b6c742093d | |
| parent | c4e3374faf6d5c69a22cdc2548d4c66984cb1b15 (diff) | |
qcacld-3.0: Validate netlink packet length
qcacld-2.0 to qcacld-3.0 propagation
There is possibility of out of bound memory access, if user
sends a netlink packet with message length greater than skb's
len.
Validate netlink packet lenght properly, by checking whole
(including header) netlink packet size with skb's len.
Change-Id: Ia6fc1a4c090084ad197ae198404c9083d0acb8e4
CRs-Fixed: 1075397
| -rw-r--r-- | core/utils/logging/src/wlan_logging_sock_svc.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/core/utils/logging/src/wlan_logging_sock_svc.c b/core/utils/logging/src/wlan_logging_sock_svc.c index 6d7dcce1a671..4396139f6c18 100644 --- a/core/utils/logging/src/wlan_logging_sock_svc.c +++ b/core/utils/logging/src/wlan_logging_sock_svc.c @@ -184,7 +184,7 @@ static int wlan_send_sock_msg_to_app(tAniHdr *wmsg, int radio, tAniNlHdr *wnl = NULL; struct sk_buff *skb; struct nlmsghdr *nlh; - int wmsg_length = wmsg->length; + int wmsg_length = ntohs(wmsg->length); static int nlmsg_seq; if (radio < 0 || radio > ANI_MAX_RADIOS) { @@ -866,7 +866,7 @@ static int wlan_logging_proc_sock_rx_msg(struct sk_buff *skb) tAniNlHdr *wnl; int radio; int type; - int ret; + int ret, len; wnl = (tAniNlHdr *) skb->data; radio = wnl->radio; @@ -878,6 +878,15 @@ static int wlan_logging_proc_sock_rx_msg(struct sk_buff *skb) return -EINVAL; } + len = ntohs(wnl->wmsg.length) + sizeof(tAniNlHdr); + if (len > skb_headlen(skb)) { + LOGGING_TRACE(QDF_TRACE_LEVEL_ERROR, + "%s: invalid length, msgLen:%x skb len:%x headLen: %d data_len: %d", + __func__, len, skb->len, skb_headlen(skb), + skb->data_len); + return -EINVAL; + } + if (gapp_pid != INVALID_PID) { if (wnl->nlh.nlmsg_pid > gapp_pid) { gapp_pid = wnl->nlh.nlmsg_pid; |