From dd20cdde181ecba8aa10c4bd5b087593a17438fe Mon Sep 17 00:00:00 2001 From: Hanumanth Reddy Pothula Date: Mon, 5 Dec 2016 15:17:05 +0530 Subject: qcacld-3.0: Validate netlink packet length qcacld-2.0 to qcacld-3.0 propagation There is possibility of out of bound memory access, if user sends a netlink packet with message length greater than skb's len. Validate netlink packet lenght properly, by checking whole (including header) netlink packet size with skb's len. Change-Id: Ia6fc1a4c090084ad197ae198404c9083d0acb8e4 CRs-Fixed: 1075397 --- core/utils/logging/src/wlan_logging_sock_svc.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/core/utils/logging/src/wlan_logging_sock_svc.c b/core/utils/logging/src/wlan_logging_sock_svc.c index 6d7dcce1a671..4396139f6c18 100644 --- a/core/utils/logging/src/wlan_logging_sock_svc.c +++ b/core/utils/logging/src/wlan_logging_sock_svc.c @@ -184,7 +184,7 @@ static int wlan_send_sock_msg_to_app(tAniHdr *wmsg, int radio, tAniNlHdr *wnl = NULL; struct sk_buff *skb; struct nlmsghdr *nlh; - int wmsg_length = wmsg->length; + int wmsg_length = ntohs(wmsg->length); static int nlmsg_seq; if (radio < 0 || radio > ANI_MAX_RADIOS) { @@ -866,7 +866,7 @@ static int wlan_logging_proc_sock_rx_msg(struct sk_buff *skb) tAniNlHdr *wnl; int radio; int type; - int ret; + int ret, len; wnl = (tAniNlHdr *) skb->data; radio = wnl->radio; @@ -878,6 +878,15 @@ static int wlan_logging_proc_sock_rx_msg(struct sk_buff *skb) return -EINVAL; } + len = ntohs(wnl->wmsg.length) + sizeof(tAniNlHdr); + if (len > skb_headlen(skb)) { + LOGGING_TRACE(QDF_TRACE_LEVEL_ERROR, + "%s: invalid length, msgLen:%x skb len:%x headLen: %d data_len: %d", + __func__, len, skb->len, skb_headlen(skb), + skb->data_len); + return -EINVAL; + } + if (gapp_pid != INVALID_PID) { if (wnl->nlh.nlmsg_pid > gapp_pid) { gapp_pid = wnl->nlh.nlmsg_pid; -- cgit v1.2.3