lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Fix possible OOB issue in ol_tx_desc_update_group_credit

Browse Source 
Currently tx desc id is extracted from HTT message and it is used
without check. This may cause possible OOB array read. To address
this add check for valid tx desc id.

Change-Id: I121fc4d550aa587f00ec315e3a20dfb136f4d7af
CRs-Fixed: 2225461
This commit is contained in:
Sravan Kumar Kairam 2018-05-09 17:16:12 +05:30 committed by nshrivas
parent 8bc7fe7172
commit 2be2792e2e
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
core/dp/txrx/ol_tx_send.c
View File

@ -833,6 +833,11 @@ void ol_tx_desc_update_group_credit(ol_txrx_pdev_handle pdev,
uint16_t vdev_id_mask;
struct ol_tx_desc_t *tx_desc;
if (tx_desc_id >= pdev->tx_desc.pool_size) {
qdf_print("%s: Invalid desc id", __func__);
return;
}
tx_desc = ol_tx_desc_find(pdev, tx_desc_id);
for (i = 0; i < OL_TX_MAX_TXQ_GROUPS; i++) {
vdev_id_mask =