From 641da0f2c6c8ab6c1909dd0b36a3b2ddcb1a8bd5 Mon Sep 17 00:00:00 2001 From: SaidiReddy Yenuga Date: Thu, 3 Nov 2016 15:54:16 +0530 Subject: qcacld-2.0: Fix untrusted pointer dereference in hdd driver command In hdd_driver_command API user space pointer priv_data.buf dereferenced without sanitization in GETOPPORTUNISTICRSSIDIFF and GETROAMRESCANRSSIDIFF cases. Use kernel space pointer command instead of priv_data.buf CRs-Fixed: 1074779 Change-Id: Ifddb01bdee501bf467d62b81a987fb9d29b44691 --- CORE/HDD/src/wlan_hdd_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c index 1e58d4978011..9a1922bd851c 100644 --- a/CORE/HDD/src/wlan_hdd_main.c +++ b/CORE/HDD/src/wlan_hdd_main.c @@ -6455,7 +6455,7 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter, pAdapter->sessionId, nOpportunisticThresholdDiff); } - else if (strncmp(priv_data.buf, "GETOPPORTUNISTICRSSIDIFF", 24) == 0) + else if (strncmp(command, "GETOPPORTUNISTICRSSIDIFF", 24) == 0) { tANI_S8 val = sme_GetRoamOpportunisticScanThresholdDiff( pHddCtx->hHal); @@ -6498,7 +6498,7 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter, pAdapter->sessionId, nRoamRescanRssiDiff); } - else if (strncmp(priv_data.buf, "GETROAMRESCANRSSIDIFF", 21) == 0) + else if (strncmp(command, "GETROAMRESCANRSSIDIFF", 21) == 0) { tANI_U8 val = sme_GetRoamRescanRssiDiff(pHddCtx->hHal); char extra[32]; -- cgit v1.2.3