lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mac80211: fix possible oob and null pointer dereferenced issues

Browse Source 
Add check to avoid array supp_rates out of bound access in function
sta_apply_parameters() and also add skb null pointer check before
access.

Change-Id: Ieeb2868b10019b5748732e28688ede36ca72b0cc
Signed-off-by: Huashan Qu <hqu@codeaurora.org>
This commit is contained in:
Huashan Qu 2021-05-27 17:24:53 +08:00
parent 0d4feea67e
commit 31c2439207
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/mac80211/cfg.c
View File

@ -1477,6 +1477,8 @@ static int sta_apply_parameters(struct ieee80211_local *local,
}
if (params->supported_rates && params->supported_rates_len) {
if (sband->band >= NUM_NL80211_BANDS)
return -EINVAL;
ieee80211_parse_bitrates(&sdata->vif.bss_conf.chandef,
sband, params->supported_rates,
params->supported_rates_len,

4
net/mac80211/wpa.c
View File

@ -991,6 +991,8 @@ ieee80211_crypto_aes_cmac_256_encrypt(struct ieee80211_tx_data *tx)
return TX_DROP;
skb = skb_peek(&tx->skbs);
if (!skb)
return TX_DROP;
info = IEEE80211_SKB_CB(skb);
@ -1136,6 +1138,8 @@ ieee80211_crypto_aes_gmac_encrypt(struct ieee80211_tx_data *tx)
return TX_DROP;
skb = skb_peek(&tx->skbs);
if (!skb)
return TX_DROP;
info = IEEE80211_SKB_CB(skb);