rubenslte/android_kernel_samsung_msm8226-rubenslte
1
Fork 0
forked from rubenslte/android_kernel_samsung_msm8226
Code Pull Requests Activity

wlan: Add sanity check to limit mgmt frames data len

Browse Source 
Currently the frameLen in Rx pkt meta is not checked for
upper bound in peHandleMgmtFrame.

Add sanity check to drop the packet if frameLen is
greater than 2000 bytes. Also add upper bound check for
frameLen in limProcessAuthFrame function.

Change-Id: Id8d80f892c18d044896224c22b21f667ee30eb6b
CRs-Fixed: 2146331
This commit is contained in:
Vignesh Viswanathan
2020-05-21 10:54:19 +02:00
committed by Francescodario Cuzzocrea
parent 62fbd622f0
commit 09edd8afac
3 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/staging/prima/CORE/MAC/src/pe/lim/limApi.c
+7
View File
@@ -1373,6 +1373,7 @@ VOS_STATUS peHandleMgmtFrame( v_PVOID_t pvosGCtx, v_PVOID_t vosBuff)
vos_pkt_t *pVosPkt;
VOS_STATUS vosStatus;
v_U8_t *pRxPacketInfo;
tANI_U16 frameLen;
pVosPkt = (vos_pkt_t *)vosBuff;
if (NULL == pVosPkt)
@@ -1396,6 +1397,12 @@ VOS_STATUS peHandleMgmtFrame( v_PVOID_t pvosGCtx, v_PVOID_t vosBuff)
return VOS_STATUS_E_FAILURE;
}
frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
if (frameLen > WDA_MAX_MGMT_MPDU_LEN) {
PELOG1(limLog(pMac, LOG1, FL("Dropping frame of len %d"), frameLen));
vos_pkt_return_packet(pVosPkt);
return VOS_STATUS_E_FAILURE;
}
//
// The MPDU header is now present at a certain "offset" in
drivers/staging/prima/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
+2 -1
View File
@@ -291,7 +291,8 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
goto free;
}
if (frameLen < LIM_ENCR_AUTH_BODY_LEN_SAP)
if ((frameLen < LIM_ENCR_AUTH_BODY_LEN_SAP) ||
(frameLen > LIM_ENCR_AUTH_BODY_LEN))
{
// Log error
limLog(pMac, LOGE,
drivers/staging/prima/CORE/WDA/inc/wlan_qct_wda.h
+2
View File
@@ -771,6 +771,8 @@ tBssSystemRole wdaGetGlobalSystemRole(tpAniSirGlobal pMac);
#define WLANWDA_HO_IS_AN_AMPDU 0x4000
#define WLANWDA_HO_LAST_MPDU_OF_AMPDU 0x400
#define WDA_MAX_MGMT_MPDU_LEN 2000
/* WDA_IS_RX_AN_AMPDU ********************************************************/
# define WDA_IS_RX_AN_AMPDU(pRxMeta) \
( ((WDI_DS_RxMetaInfoType*)(pRxMeta))->rxpFlags & WLANWDA_HO_IS_AN_AMPDU )