Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1ebed1b2 authored by Jingxiang Ge's avatar Jingxiang Ge Committed by Madan Koyyalamudi
Browse files

qcacld-3.0: Check input parameters for tx_attr/rx_attr 

In hdd_config_tx_rx_nss and hdd_config_vdev_chains, it
missed to check if tx_attr or rx_attr is null, which will
cause invalid memory access.

Change-Id: Ic3427d714e240507cf4253588f706d06d355ba93
CRs-Fixed: 3086252
parent fe2654d6

core/hdd/src/wlan_hdd_cfg80211.c

+14 −0
Original line number Diff line number Diff line
@@ -7864,6 +7864,13 @@ static int hdd_config_vdev_chains(struct hdd_adapter *adapter, 
	if (!tx_attr && !rx_attr)

		return 0;













	/* if one is present, both must be present */













	if (!tx_attr || !rx_attr) {













		hdd_err("Missing attribute for %s",













			tx_attr ? "RX" : "TX");













		return -EINVAL;













	}



























	tx_chains = nla_get_u8(tx_attr);















	rx_chains = nla_get_u8(rx_attr);























@@ -7887,6 +7894,13 @@ static int hdd_config_tx_rx_nss(struct hdd_adapter *adapter,













	if (!tx_attr && !rx_attr)















		return 0;



























	/* if one is present, both must be present */













	if (!tx_attr || !rx_attr) {













		hdd_err("Missing attribute for %s",













			tx_attr ? "RX" : "TX");













		return -EINVAL;













	}



























	tx_nss = nla_get_u8(tx_attr);















	rx_nss = nla_get_u8(rx_attr);















	hdd_debug("tx_nss %d rx_nss %d", tx_nss, rx_nss);