Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 09e82e29 authored by Abhishek Ambure's avatar Abhishek Ambure Committed by Gerrit - the friendly Code Review server
Browse files

qcacld-3.0: Add max index check for dscp_to_up_map array 

In SME layer, boundary check for dscp_to_up_map array is not present.

The dscpmapping is an array of 0x40 elements. Values in dscp_exceptions
are used to index dscpmapping. The indices are not validated to be less
than 0x40. The dscp_exceptions array is received from association
response frame. A malicious AP can send values up to 0xff, causing OOB
write of dscpmapping array.

Hence, max index check is added to avoid OOB write of dscpmapping array.

Change-Id: I73526849677e867673fc0bd0024ed2b003e4f89e
CRs-Fixed: 2569764
parent 7564e615

core/hdd/inc/wlan_hdd_main.h

+1 −1
Original line number Diff line number Diff line
@@ -1589,7 +1589,7 @@ struct hdd_adapter_s { 
	bool offloads_configured;



	/* DSCP to UP QoS Mapping */

	sme_QosWmmUpType hddWmmDscpToUpMap[WLAN_HDD_MAX_DSCP + 1];

	sme_QosWmmUpType hddWmmDscpToUpMap[WLAN_MAX_DSCP + 1];



#ifdef WLAN_FEATURE_LINK_LAYER_STATS

	bool isLinkLayerStatsSet;

core/hdd/inc/wlan_hdd_wmm.h

+1 −3
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2011-2012,2016-2017 The Linux Foundation. All rights reserved.

 * Copyright (c) 2011-2012,2016-2017, 2019 The Linux Foundation. All rights reserved.

 *

 * Permission to use, copy, modify, and/or distribute this software for

 * any purpose with or without fee is hereby granted, provided that the
@@ -194,8 +194,6 @@ extern const uint8_t hdd_qdisc_ac_to_tl_ac[]; 
extern const uint8_t hdd_wmm_up_to_ac_map[];

extern const uint8_t hdd_linux_up_to_ac_map[];



#define WLAN_HDD_MAX_DSCP 0x3f



/**

 * hdd_wmmps_helper() - Function to set uapsd psb dynamically

 *

core/hdd/src/wlan_hdd_wmm.c

+2 −4
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2013-2018 The Linux Foundation. All rights reserved.

 * Copyright (c) 2013-2019 The Linux Foundation. All rights reserved.

 *

 * Permission to use, copy, modify, and/or distribute this software for

 * any purpose with or without fee is hereby granted, provided that the
@@ -54,8 +54,6 @@ 
#include <cds_sched.h>

#include "sme_api.h"



#define WLAN_HDD_MAX_DSCP 0x3f



#define HDD_WMM_UP_TO_AC_MAP_SIZE 8



const uint8_t hdd_wmm_up_to_ac_map[] = {
@@ -1281,7 +1279,7 @@ QDF_STATUS hdd_wmm_init(hdd_adapter_t *pAdapter) 
	/* DSCP to User Priority Lookup Table

	 * By default use the 3 Precedence bits of DSCP as the User Priority

	 */

	for (dscp = 0; dscp <= WLAN_HDD_MAX_DSCP; dscp++)

	for (dscp = 0; dscp <= WLAN_MAX_DSCP; dscp++)

		hddWmmDscpToUpMap[dscp] = dscp >> 3;



	/* Special case for Expedited Forwarding (DSCP 46) */

core/sme/inc/sme_qos_api.h

+3 −1
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2014-2017 The Linux Foundation. All rights reserved.

 * Copyright (c) 2014-2017, 2019 The Linux Foundation. All rights reserved.

 *

 * Permission to use, copy, modify, and/or distribute this software for

 * any purpose with or without fee is hereby granted, provided that the
@@ -42,6 +42,8 @@ 
#define SME_QOS_UAPSD_VI      0x02

#define SME_QOS_UAPSD_BE      0x08

#define SME_QOS_UAPSD_BK      0x04

#define WLAN_MAX_DSCP 0x3f





/*---------------------------------------------------------------------------

  Enumeration of the various QoS status types that would be reported to HDD

core/sme/src/common/sme_api.c

+3 −12
Original line number Diff line number Diff line
@@ -13974,21 +13974,12 @@ QDF_STATUS sme_update_dsc_pto_up_mapping(tHalHandle hHal, 
	}

	for (i = 0; i < SME_QOS_WMM_UP_MAX; i++) {

		for (j = pSession->QosMapSet.dscp_range[i][0];

			j <= pSession->QosMapSet.dscp_range[i][1];

			j++) {

			if ((pSession->QosMapSet.dscp_range[i][0] == 255)

				&& (pSession->QosMapSet.dscp_range[i][1] ==

							255)) {

				QDF_TRACE(QDF_MODULE_ID_SME,

					QDF_TRACE_LEVEL_DEBUG,

					FL("User Priority %d isn't used"), i);

				break;

			}

			j <= pSession->QosMapSet.dscp_range[i][1] &&

			j <= WLAN_MAX_DSCP; j++)

			dscpmapping[j] = i;

	}

	}

	for (i = 0; i < pSession->QosMapSet.num_dscp_exceptions; i++)

		if (pSession->QosMapSet.dscp_exceptions[i][0] != 255)

		if (pSession->QosMapSet.dscp_exceptions[i][0] <= WLAN_MAX_DSCP)

			dscpmapping[pSession->QosMapSet.dscp_exceptions[i][0]] =

				pSession->QosMapSet.dscp_exceptions[i][1];