diff options
| author | Sravan Kumar Kairam <sgoud@codeaurora.org> | 2018-07-10 20:04:28 +0800 |
|---|---|---|
| committer | Shirle Yuen <shirleyshukyee@google.com> | 2018-07-27 16:14:26 -0700 |
| commit | 07ee0b7618f1c16c4420c29c6bfa566ce2b8f9a0 (patch) | |
| tree | 8f54639234cc86bf657bf5c0e560c028a42fb667 | |
| parent | a1dff508c366b95a93d9a1cef6e2e0377c1f0012 (diff) | |
| download | qcom-msm8x09-v3.10-07ee0b7618f1c16c4420c29c6bfa566ce2b8f9a0.tar.gz | |
qcacld-2.0: Fix possible OOB issue in ol_tx_desc_update_group_credit
Currently tx desc id is extracted from HTT message and it is used
without check. This may cause possible OOB array read. To address
this add check for valid tx desc id.
Change-Id: I121fc4d550aa587f00ec315e3a20dfb136f4d7af
CRs-Fixed: 2225461
Bug: 111289931
(cherry picked from commit 673b5f62dcfa83fcbd459916cde55930b82fff03)
| -rw-r--r-- | drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_send.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_send.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_send.c index bc6120b6749..1397f1121fd 100644 --- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_send.c +++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_send.c @@ -805,6 +805,12 @@ ol_tx_desc_update_group_credit(ol_txrx_pdev_handle pdev, u_int16_t tx_desc_id, uint16_t vdev_id_mask; struct ol_tx_desc_t *tx_desc; + if (tx_desc_id >= pdev->tx_desc.pool_size) { + VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR, + "%s: Invalid desc id %d", __func__, tx_desc_id); + return; + } + tx_desc = ol_tx_desc_find(pdev, tx_desc_id); for (i = 0; i < OL_TX_MAX_TXQ_GROUPS; i++) { |