qcacld-2.0: Fix potential buffer overwrite in wma_vdev_start_rsp_ind
In function wma_vdev_start_rsp_ind, vdev_id is received from the FW
and is used to access wma_handle->interfaces without validating the
upper limit. If the value of vdev_id received from the FW is not
less than max_bssid, then a buffer overwrite will occur in the
function wma_vdev_start_rsp_ind.
Add sanity check to make sure vdev_id is less than max_bssid.
Change-Id: I83e1b797ca50a7fb58519f66dde26b035a2393ce
CRs-Fixed: 2150359
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 5a2f0fb..aab897e 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -548,7 +548,7 @@
{
struct wma_txrx_node *intf = wma->interfaces;
- if (vdev_id > wma->max_bssid) {
+ if (vdev_id >= wma->max_bssid) {
WMA_LOGP("%s: Invalid vdev_id %hu", __func__, vdev_id);
VOS_ASSERT(0);
return false;
@@ -574,7 +574,7 @@
{
struct wma_txrx_node *intf = wma->interfaces;
- if (vdev_id > wma->max_bssid) {
+ if (vdev_id >= wma->max_bssid) {
WMA_LOGP("%s: Invalid vdev_id %hu", __func__, vdev_id);
VOS_ASSERT(0);
return false;
@@ -1345,9 +1345,15 @@
return -EINVAL;
}
+ if (resp_event->vdev_id >= wma->max_bssid) {
+ WMA_LOGE("%s: received invalid vdev_id %d",
+ __func__, resp_event->vdev_id);
+ return -EINVAL;
+ }
+
iface = &wma->interfaces[resp_event->vdev_id];
- if ((resp_event->vdev_id <= wma->max_bssid) &&
+ if ((resp_event->vdev_id < wma->max_bssid) &&
(adf_os_atomic_read(
&wma->interfaces[resp_event->vdev_id].vdev_restart_params.hidden_ssid_restart_in_progress)) &&
(wma_is_vdev_in_ap_mode(wma, resp_event->vdev_id) == true)) {
@@ -1957,7 +1963,7 @@
ol_txrx_vdev_handle vdev;
ol_txrx_peer_handle peer, temp;
- if (!wma || vdev_id > wma->max_bssid)
+ if (!wma || vdev_id >= wma->max_bssid)
return;
vdev = wma->interfaces[vdev_id].handle;
@@ -1999,7 +2005,7 @@
ol_txrx_vdev_handle vdev;
ol_txrx_peer_handle peer, temp;
- if (!wma || vdev_id > wma->max_bssid)
+ if (!wma || vdev_id >= wma->max_bssid)
return;
vdev = wma->interfaces[vdev_id].handle;
@@ -2197,7 +2203,7 @@
resp_event = (wmi_vdev_stopped_event_fixed_param *)buf;
- if ((resp_event->vdev_id <= wma->max_bssid) &&
+ if ((resp_event->vdev_id < wma->max_bssid) &&
(adf_os_atomic_read(&wma->interfaces[resp_event->vdev_id].vdev_restart_params.hidden_ssid_restart_in_progress)) &&
((wma->interfaces[resp_event->vdev_id].type == WMI_VDEV_TYPE_AP) &&
(wma->interfaces[resp_event->vdev_id].sub_type == 0))) {
@@ -2236,7 +2242,7 @@
tpDeleteBssParams params =
(tpDeleteBssParams)req_msg->user_data;
struct beacon_info *bcn;
- if (resp_event->vdev_id > wma->max_bssid) {
+ if (resp_event->vdev_id >= wma->max_bssid) {
WMA_LOGE("%s: Invalid vdev_id %d", __func__,
resp_event->vdev_id);
vos_mem_free(params);
@@ -11962,7 +11968,7 @@
int len;
tSirScanOffloadEvent *scan_event;
- if (scan_req->sessionId > wma_handle->max_bssid) {
+ if (scan_req->sessionId >= wma_handle->max_bssid) {
WMA_LOGE("%s: Invalid vdev_id %d, msg_type : 0x%x", __func__,
scan_req->sessionId, msg_type);
vos_status = VOS_STATUS_E_FAILURE;
@@ -14943,7 +14949,7 @@
struct beacon_info *bcn;
struct wma_txrx_node *iface;
- if (tgt_req->vdev_id > wma->max_bssid) {
+ if (tgt_req->vdev_id >= wma->max_bssid) {
WMA_LOGE("%s: Invalid vdev_id %d", __func__,
tgt_req->vdev_id);
vos_mem_free(params);
@@ -25823,7 +25829,7 @@
WMA_LOGD("wow enable req received for vdev id: %d", info->sessionId);
- if (info->sessionId > wma->max_bssid) {
+ if (info->sessionId >= wma->max_bssid) {
WMA_LOGE("Invalid vdev id (%d)", info->sessionId);
vos_mem_free(info);
return VOS_STATUS_E_INVAL;
@@ -25850,7 +25856,7 @@
WMA_LOGD("wow disable req received for vdev id: %d", info->sessionId);
- if (info->sessionId > wma->max_bssid) {
+ if (info->sessionId >= wma->max_bssid) {
WMA_LOGE("Invalid vdev id (%d)", info->sessionId);
vos_mem_free(info);
return VOS_STATUS_E_INVAL;
@@ -25883,7 +25889,7 @@
wma->no_of_suspend_ind++;
- if (info->sessionId > wma->max_bssid) {
+ if (info->sessionId >= wma->max_bssid) {
WMA_LOGE("Invalid vdev id (%d)", info->sessionId);
vos_mem_free(info);
return VOS_STATUS_E_INVAL;
diff --git a/CORE/SERVICES/WMA/wma_nan_datapath.c b/CORE/SERVICES/WMA/wma_nan_datapath.c
index 4597a7c..adaca21 100644
--- a/CORE/SERVICES/WMA/wma_nan_datapath.c
+++ b/CORE/SERVICES/WMA/wma_nan_datapath.c
@@ -1201,7 +1201,7 @@
ol_txrx_vdev_handle vdev;
ol_txrx_peer_handle peer, temp;
- if (!wma || vdev_id > wma->max_bssid)
+ if (!wma || vdev_id >= wma->max_bssid)
return;
vdev = wma->interfaces[vdev_id].handle;
