Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 678bee34 authored by Rajeev Kumar Sirasanagandla's avatar Rajeev Kumar Sirasanagandla Committed by nshrivas
Browse files

qcacld-3.0: Avoid info leak in spectral scan handler 

In __spectral_scan_msg_handler(), payload section of input data is
type casted to driver internal structure spectral_scan_msg without
validating payload length which can lead to kernel info leak
if the payload length is less than size of spectral_scan_msg.

To fix this, avoid type-cast and return error if payload length is
less than size of spectral_scan_msg.

Change-Id: Ie7e74cc2cdcf8136582e81ffc3a088fd5a881dc9
CRs-Fixed: 2468493
parent e195e362

core/hdd/src/wlan_hdd_spectral.c

+12 −2
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2017-2018 The Linux Foundation. All rights reserved.

 * Copyright (c) 2017-2019 The Linux Foundation. All rights reserved.

 *

 * Permission to use, copy, modify, and/or distribute this software for

 * any purpose with or without fee is hereby granted, provided that the
@@ -391,7 +391,7 @@ static void __spectral_scan_msg_handler(const void *data, int data_len, 
					void *ctx, int pid)

{

	struct spectral_scan_msg *ss_msg = NULL;

	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MAX + 1];

	struct nlattr *tb[CLD80211_ATTR_MAX + 1];

	hdd_context_t *hdd_ctx;

	int ret;
@@ -400,6 +400,10 @@ static void __spectral_scan_msg_handler(const void *data, int data_len, 
	if (0 != ret)

		return;



	/*

	 * audit note: it is ok to pass a NULL policy here since only

	 * one attribute is parsed and it is explicitly validated

	 */

	if (hdd_nla_parse(tb, CLD80211_ATTR_MAX, data, data_len, NULL)) {

		hdd_err("nla parse fails");

		return;
@@ -409,6 +413,12 @@ static void __spectral_scan_msg_handler(const void *data, int data_len, 
		hdd_err("attr VENDOR_DATA fails");

		return;

	}



	if (nla_len(tb[CLD80211_ATTR_DATA]) < sizeof(*ss_msg)) {

		hdd_err("Invalid length for ATTR_DATA");

		return;

	}



	ss_msg = (struct spectral_scan_msg *)nla_data(tb[CLD80211_ATTR_DATA]);



	if (!ss_msg) {