DivestOS/Patches/Linux_CVEs-New/CVE-2016-10283/ANY/1.patch
2017-10-29 14:23:02 -04:00

45 lines
1.8 KiB
Diff

From 5842cb5d592b7a4b89f2459ba71f78d860eb6267 Mon Sep 17 00:00:00 2001
From: SaidiReddy Yenuga <saidir@codeaurora.org>
Date: Wed, 5 Apr 2017 13:18:26 +0530
Subject: wlan: Trim operation classes to max supported in change station
qcacld-2.0 to prima propagation.
Operation classes supported can be controlled by user, which can
be sent greater than the max supported operations. This results
in stack overflow in change station command.
Add check to validate operations supported param given by user
and if it exceeds max supported value, set it to max supported
value.
CRs-Fixed: 2002052
Change-Id: Idd3a35e38b091546a17d7ec6329f19429e5c289c
---
CORE/HDD/src/wlan_hdd_cfg80211.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index 66c732e..5a35945 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -11611,6 +11611,15 @@ static int __wlan_hdd_change_station(struct wiphy *wiphy,
}
StaParams.supported_channels_len = j;
}
+ if (params->supported_oper_classes_len >
+ SIR_MAC_MAX_SUPP_OPER_CLASSES) {
+ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+ "received oper classes:%d, resetting it to max supported %d",
+ params->supported_oper_classes_len,
+ SIR_MAC_MAX_SUPP_OPER_CLASSES);
+ params->supported_oper_classes_len =
+ SIR_MAC_MAX_SUPP_OPER_CLASSES;
+ }
vos_mem_copy(StaParams.supported_oper_classes,
params->supported_oper_classes,
params->supported_oper_classes_len);
--
cgit v1.1