commit 2d5cba75217292e1f3f7d1e27e5acea6c85500cb
author Manjeet Singh <manjee@codeaurora.org> Fri Feb 10 19:03:38 2017 +0530
committer Karsten Tausche <karsten@fairphone.com> Thu Nov 21 14:35:47 2019 +0100
tree d4cac1abc46bb8be453564332e78a5039a93404f
parent 15ca8ababbd34560f27c96dcad49ea95b3cf7eaa

wlan: Add buf len check in wlan_hdd_cfg80211_testmode

In __wlan_hdd_cfg80211_testmode API no checks are in place that
ensure that buflen is smaller or equal the size of the stack
variable hb_params. Hence, the vos_mem_copy() call can overflow
stack memory.

Add buf len check to avoid stack overflow.

Issue: SEC-2081
CRs-Fixed: 1105085
Change-Id: I6af6a74cc38ebce3337120adcf7e9595f22d3d8c
(adapted from commit a577dc1838b92eb0e7ecf16401e7a2b5e3238e61)

drivers/staging/prima/CORE/HDD/src/wlan_hdd_cfg80211.c

diff --git a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_cfg80211.c b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_cfg80211.c
index 9ed8070..2584ccb 100644
--- a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -16574,6 +16574,12 @@
             buf = nla_data(tb[WLAN_HDD_TM_ATTR_DATA]);
             buf_len = nla_len(tb[WLAN_HDD_TM_ATTR_DATA]);
 
+            if (buf_len > sizeof(*hb_params)) {
+                hddLog(LOGE, FL("buf_len=%d exceeded hb_params size limit"),
+                       buf_len);
+                return -ERANGE;
+            }
+
             hb_params_temp =(tSirLPHBReq *)buf;
             if ((hb_params_temp->cmd == LPHB_SET_TCP_PARAMS_INDID) &&
                 (hb_params_temp->params.lphbTcpParamReq.timePeriodSec == 0))