From 715a9dc0d2b82a013fd38bf66861f7fbbca78ca4 Mon Sep 17 00:00:00 2001 From: Wu Gao Date: Tue, 6 Dec 2022 16:31:04 +0800 Subject: [PATCH] qcacld-3.0: Fix OOB issue when access wma_find_vdev_by_addr The function 'wma_find_vdev_by_addr' returns pointer to cdp_vdev, so should avoid to comapre with QDF_STATUS_SUCCESS. Change-Id: Ia302fcc8e705cc01a27bd1dce9f7cb09a8ef29b0 CRs-Fixed: 3346764 Mot-CRs-fixed: (CR) CVE- fixed: CVE-2023-21669 QC-CR#3346764 Signed-off-by: Sipra Patel Change-Id: Ia302fcc8e705cc01a27bd1dce9f7cb09a8ef29b0 Reviewed-on: https://gerrit.mot.com/2594389 SME-Granted: SME Approvals Granted SLTApproved: Slta Waiver Tested-by: Jira Key Reviewed-by: Zhengjie Zhu Reviewed-by: Bin Liu Submit-Approved: Jira Key --- core/wma/src/wma_mgmt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c index 00ba18715cca..584d5e49ed06 100644 --- a/core/wma/src/wma_mgmt.c +++ b/core/wma/src/wma_mgmt.c @@ -1,5 +1,6 @@ /* * Copyright (c) 2013-2020 The Linux Foundation. All rights reserved. + * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -3478,7 +3479,7 @@ int wma_form_rx_packet(qdf_nbuf_t buf, if (status) return status; } else if (wma_find_vdev_id_by_addr(wma_handle, wh->i_addr1, - &vdev_id) == QDF_STATUS_SUCCESS) { + &vdev_id)) { status = wma_check_and_process_rmf_frame(wma_handle, vdev_id, &wh,