commit 9c93f56775634292b48ebea2ef614047ed3303bf
author Ashish Kumar Dhanotiya <adhanoti@codeaurora.org> Tue Jun 20 12:13:33 2017 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> Wed Jul 05 06:16:49 2017 -0700
tree 7e4b51ba55d93a22fff929fba72579ff3f1d9c50
parent 291b85c5e9e0ed6b2a98cca1700bcb13cbdc3563

wlan: Avoid extscan bucket spec overread

Propagation from qcacld-2.0 to prima.

Currently in hdd_extscan_start_fill_bucket_channel_spec() the
QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC attribute is parsed without
specifying a policy. This means that no policy is enforced.
Subsequently the values of the nested attributes are retrieved, but
again without any length limits enforced. This could result in a
buffer overread.
To prevent this issue:
* Parse using the existing policy wlan_hdd_extscan_config_policy
* Update the policy to add missing attributes

Change-Id: I3b20cb28d1beccd2e804b022b531413ad1edb533
CRs-Fixed: 2058442

CORE/HDD/src/wlan_hdd_cfg80211.c

diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index e826f0c..c23e376 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -3815,8 +3815,9 @@
     nla_for_each_nested(buckets,
             tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC], rem1) {
         if (nla_parse(bucket,
-            QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX,
-            nla_data(buckets), nla_len(buckets), NULL)) {
+                      QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX,
+                      nla_data(buckets), nla_len(buckets),
+                      wlan_hdd_extscan_config_policy)) {
             hddLog(LOGE, FL("nla_parse failed"));
             return -EINVAL;
         }