diff options
| author | Dennis Jeon <dennis.jeon@broadcom.corp-partner.google.com> | 2024-04-01 01:23:37 -0400 |
|---|---|---|
| committer | Isaac Chiou <isaacchiou@google.com> | 2024-04-08 09:44:05 +0000 |
| commit | 99c9d3171121413c18144a1575c912c5cb41126a (patch) | |
| tree | f31f811ae5842170366de7a1475a4ddc834f566d | |
| parent | ca46c9c1b17a304a47b6ff85b3339706ef5cf495 (diff) | |
| download | bcm4389-99c9d3171121413c18144a1575c912c5cb41126a.tar.gz | |
bcmdhd: Fixed OOB write possibility in wl event handler (wl_notify_rx_mgmt_frame)
Bug: 322820125
Test: no issue is seen in MTBF
Test: AU drop test
Change-Id: I4e3185ac81685b54e8c9eccfe3a5a165380b8501
Signed-off-by: Dennis Jeon <dennis.jeon@broadcom.corp-partner.google.com>
| -rw-r--r-- | wl_cfg80211.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/wl_cfg80211.c b/wl_cfg80211.c index 3802ed0..53d79bd 100644 --- a/wl_cfg80211.c +++ b/wl_cfg80211.c @@ -15302,10 +15302,6 @@ wl_notify_rx_mgmt_frame(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev, #if defined(BCMDONGLEHOST) && defined(TDLS_MSG_ONLY_WFD) && defined(WLTDLS) dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub); #endif /* BCMDONGLEHOST && TDLS_MSG_ONLY_WFD && WLTDLS */ - if (ntoh32(e->datalen) < sizeof(wl_event_rx_frame_data_t)) { - WL_ERR(("wrong datalen:%d\n", ntoh32(e->datalen))); - return -EINVAL; - } rxframe = (wl_event_rx_frame_data_t *)data; if (!rxframe) { @@ -15315,9 +15311,19 @@ wl_notify_rx_mgmt_frame(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev, /* Handle different versions of Rx frame data */ if (ntoh16(rxframe->version) == BCM_RX_FRAME_DATA_VERSION_1) { + if (ntoh32(e->datalen) < sizeof(wl_event_rx_frame_data_v1_t)) { + WL_ERR(("wrong datalen:%d for rxframe v1:%lu\n", + ntoh32(e->datalen), sizeof(wl_event_rx_frame_data_v1_t))); + return -EINVAL; + } mgmt_frame_len = ntoh32(e->datalen) - (uint32)sizeof(wl_event_rx_frame_data_v1_t); rx_event_data = (u8 *) ((wl_event_rx_frame_data_v1_t *)rxframe + 1); } else if (ntoh16(rxframe->version) == BCM_RX_FRAME_DATA_VERSION_2) { + if (ntoh32(e->datalen) < sizeof(wl_event_rx_frame_data_v2_t)) { + WL_ERR(("wrong datalen:%d for rxframe v2:%lu\n", + ntoh32(e->datalen), sizeof(wl_event_rx_frame_data_v2_t))); + return -EINVAL; + } mgmt_frame_len = ntoh32(e->datalen) - (uint32)sizeof(wl_event_rx_frame_data_v2_t); rx_event_data = (u8 *) ((wl_event_rx_frame_data_v2_t *)rxframe + 1); } else { |