From 0b049a8a41b660d04c183bb39f371adada05f2c6 Mon Sep 17 00:00:00 2001 From: Jingxiang Ge Date: Thu, 15 Mar 2018 15:47:47 +0800 Subject: [PATCH] qcacld-3.0: Fix regression issue for ipa init failure When get length by HTT_WDI_IPA_OP_RESPONSE_RSP_LEN_GET, the input msg_word needs to shift 4Bytes. Failure length check will cause ipa uc event without processing. Regression cause Iddf2df0fd65f5b33b54f1a608cdd34e400c0e03c. Change-Id: I41a44ae26f84d974cbd3242f4454ec6068d7b68b CRs-Fixed: 2206296 --- core/dp/htt/htt_t2h.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/core/dp/htt/htt_t2h.c b/core/dp/htt/htt_t2h.c index 626fb514a778..7daa1fbf758f 100644 --- a/core/dp/htt/htt_t2h.c +++ b/core/dp/htt/htt_t2h.c @@ -512,10 +512,14 @@ static void htt_t2h_lp_msg_handler(void *context, qdf_nbuf_t htt_t2h_msg, { uint16_t len; int msg_len = qdf_nbuf_len(htt_t2h_msg); - len = HTT_WDI_IPA_OP_RESPONSE_RSP_LEN_GET(*msg_word); + len = HTT_WDI_IPA_OP_RESPONSE_RSP_LEN_GET(*(msg_word + 1)); if (sizeof(struct htt_wdi_ipa_op_response_t) + len > msg_len) { - qdf_print("Invalid buffer length"); + qdf_print("Invalid buffer length," + "sizeof(struct htt_wdi_ipa_op_response_t) %lu" + "len %d, msg_len %d", + sizeof(struct htt_wdi_ipa_op_response_t), + len, msg_len); WARN_ON(1); break; }