Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ccd086c3 authored by sheenam monga's avatar sheenam monga Committed by Madan Koyyalamudi
Browse files

qcacmn: Fix possible OOB in wmi_extract_dbr_buf_release_entry 

Currently in function wmi_extract_dbr_buf_release_entry,
num_buf_release_entry & num_meta_data_entry are copied
to direct_buf_rx_rsp structure without any validation which
may cause out of bound issue if num_buf_release_entry or
num_meta_data_entries provided in fixed param becomes greater
than actual number of entries.

Fix is to validate num_entries and num_meta_data before populating
param->num_buf_release_entry and param->num_meta_data_entry.

Change-Id: I18050fd4f90f8815d7eceb5f715fdbaa09130d3a
CRs-Fixed: 3000875
parent d0f8b3fe

target_if/direct_buf_rx/src/target_if_direct_buf_rx_main.c

+5 −0
Original line number Diff line number Diff line
@@ -1845,6 +1845,11 @@ static int target_if_direct_buf_rx_rsp_event_handler(ol_scn_t scn, 
	dbr_buf_pool = mod_param->dbr_buf_pool;

	dbr_rsp.dbr_entries = qdf_mem_malloc(dbr_rsp.num_buf_release_entry *

					sizeof(struct direct_buf_rx_entry));

	if (!dbr_rsp.dbr_entries) {

		direct_buf_rx_err("invalid dbr_entries");

		wlan_objmgr_pdev_release_ref(pdev, dbr_mod_id);

		return QDF_STATUS_E_FAILURE;

	}



	if (dbr_rsp.num_meta_data_entry > dbr_rsp.num_buf_release_entry) {

		direct_buf_rx_err("More than expected number of metadata");

wmi/src/wmi_unified_dbr_tlv.c

+11 −1
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2016-2020 The Linux Foundation. All rights reserved.

 * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.

 *

 * Permission to use, copy, modify, and/or distribute this software for

 * any purpose with or without fee is hereby granted, provided that the
@@ -132,7 +132,17 @@ static QDF_STATUS extract_dbr_buf_release_fixed_tlv(wmi_unified_t wmi_handle, 
								wmi_handle,

								ev->pdev_id);

	param->mod_id = ev->mod_id;

	if ((!param_buf->num_entries) ||

	    param_buf->num_entries < ev->num_buf_release_entry){

		wmi_err("actual num of buf release entries less than provided entries");

		return QDF_STATUS_E_INVAL;

	}

	param->num_buf_release_entry = ev->num_buf_release_entry;

	if ((!param_buf->num_meta_data) ||

	    param_buf->num_meta_data < ev->num_meta_data_entry) {

		wmi_err("actual num of meta data entries less than provided entries");

		return QDF_STATUS_E_INVAL;

	}

	param->num_meta_data_entry = ev->num_meta_data_entry;

	wmi_debug("pdev id %d mod id %d num buf release entry %d",

		 param->pdev_id, param->mod_id, param->num_buf_release_entry);