A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Add vdev id sanity check in wma stats event handlers

Browse source 
Stats events are sent by WLAN FW based on over the air frame reception
and may contain incorrect vdev id hence sanitize vdev id received from
FW in stats events before accessing interface array based on it.

Change-Id: I4ecc73fc27285c98c0ea8cebc27955213cd68399
CRs-Fixed: 2186953
This commit is contained in:
Rajeev Kumar 2018-02-08 18:21:57 -08:00 • committed by snandini
commit 0b071179d4
1 changed files with 18 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

18
core/wma/src/wma_utils.c
View file

@ -2456,6 +2456,12 @@ static void wma_vdev_stats_lost_link_helper(tp_wma_handle wma,
static const uint8_t zero_mac[QDF_MAC_ADDR_SIZE] = {0};
int32_t bcn_snr, dat_snr;
if (vdev_stats->vdev_id >= wma->max_bssid) {
WMA_LOGE("%s: Invalid vdev_id %hu",
__func__, vdev_stats->vdev_id);
return;
}
node = &wma->interfaces[vdev_stats->vdev_id];
if (wma_is_vdev_up(vdev_stats->vdev_id) &&
!qdf_mem_cmp(node->bssid, zero_mac, QDF_MAC_ADDR_SIZE)) {
@ -2505,6 +2511,12 @@ static void wma_update_vdev_stats(tp_wma_handle wma,
struct scheduler_msg sme_msg = { 0 };
int32_t bcn_snr, dat_snr;
if (vdev_stats->vdev_id >= wma->max_bssid) {
WMA_LOGE("%s: Invalid vdev_id %hu",
__func__, vdev_stats->vdev_id);
return;
}
bcn_snr = vdev_stats->vdev_snr.bcn_snr;
dat_snr = vdev_stats->vdev_snr.dat_snr;
WMA_LOGD("vdev id %d beancon snr %d data snr %d",
@ -2776,6 +2788,12 @@ static void wma_update_rssi_stats(tp_wma_handle wma,
uint32_t temp_mask;
uint8_t vdev_id;
if (rssi_stats->vdev_id >= wma->max_bssid) {
WMA_LOGE("%s: Invalid vdev_id %hu",
__func__, rssi_stats->vdev_id);
return;
}
vdev_id = rssi_stats->vdev_id;
node = &wma->interfaces[vdev_id];
stats_rsp_params = (tAniGetPEStatsRsp *) node->stats_rsp;