Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit a12ebb70 authored by Aditya Kodukula's avatar Aditya Kodukula Committed by Alexander Winkowski
Browse files

qcacld-3.0: Fix potential OOB memory access 

Currently in the wma_stats_ext_event_handler(), the buf_ptr
is not pointing correctly to the event data received from FW.
This is leading to an OOB memory access during qdf_mem_copy().

So, to avoid this issue correctly point the buf_ptr to the event
data sent by the FW in the TLV.

Change-Id: Iffa3e96a6a36eff5899a7a9a7febe0ebb9d7878f
CRs-Fixed: 4011656
parent f826e1ae

drivers/staging/qcacld-3.0/core/wma/src/wma_utils.c

+3 −5
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2013-2021 The Linux Foundation. All rights reserved.

 * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.

 * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.

 *

 * Permission to use, copy, modify, and/or distribute this software for

 * any purpose with or without fee is hereby granted, provided that the
@@ -708,7 +708,6 @@ int wma_stats_ext_event_handler(void *handle, uint8_t *event_buf, 
	}



	stats_ext_info = param_buf->fixed_param;

	buf_ptr = (uint8_t *)stats_ext_info;



	alloc_len = sizeof(tSirStatsExtEvent);

	alloc_len += stats_ext_info->data_len;
@@ -725,7 +724,7 @@ int wma_stats_ext_event_handler(void *handle, uint8_t *event_buf, 
	if (!stats_ext_event)

		return -ENOMEM;



	buf_ptr += sizeof(wmi_stats_ext_event_fixed_param) + WMI_TLV_HDR_SIZE;

	buf_ptr = (uint8_t *)param_buf->data;



	stats_ext_event->vdev_id = stats_ext_info->vdev_id;

	stats_ext_event->event_data_len = stats_ext_info->data_len;
@@ -775,7 +774,6 @@ int wma_stats_ext_event_handler(void *handle, uint8_t *event_buf, 
	}



	stats_ext_info = param_buf->fixed_param;

	buf_ptr = (uint8_t *)stats_ext_info;



	alloc_len = sizeof(tSirStatsExtEvent);

	alloc_len += stats_ext_info->data_len;
@@ -791,7 +789,7 @@ int wma_stats_ext_event_handler(void *handle, uint8_t *event_buf, 
	if (!stats_ext_event)

		return -ENOMEM;



	buf_ptr += sizeof(wmi_stats_ext_event_fixed_param) + WMI_TLV_HDR_SIZE;

	buf_ptr = (uint8_t *)param_buf->data;



	stats_ext_event->vdev_id = stats_ext_info->vdev_id;

	stats_ext_event->event_data_len = stats_ext_info->data_len;