A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 00:24:41 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix array out of bound access during fisa flush

Browse source 
Fisa flow entry napi id is initialized to invalid value,
which will cause out of bound access during fisa flush by vdev id.

Fix this by validating array index before access.

Change-Id: Ic7b1b1448194b75777f9dc392043275235caa7f7
CRs-Fixed: 2873033
This commit is contained in:
Karthik Kantamneni 2021-02-08 13:43:44 +05:30 • committed by snandini
commit 414155666a
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
core/dp/txrx3.0/dp_fisa_rx.c
View file

@ -1957,6 +1957,7 @@ QDF_STATUS dp_rx_fisa_flush_by_vdev_id(struct dp_soc *soc, uint8_t vdev_id)
int ft_size = fisa_hdl->max_entries;
int i;
struct dp_vdev *vdev;
uint8_t reo_id;
vdev = dp_vdev_get_ref_by_id(soc, vdev_id, DP_MOD_ID_RX);
if (qdf_unlikely(!vdev)) {
@ -1965,14 +1966,17 @@ QDF_STATUS dp_rx_fisa_flush_by_vdev_id(struct dp_soc *soc, uint8_t vdev_id)
}
for (i = 0; i < ft_size; i++) {
dp_rx_fisa_acquire_ft_lock(fisa_hdl, sw_ft_entry[i].napi_id);
reo_id = sw_ft_entry[i].napi_id;
if (reo_id >= MAX_REO_DEST_RINGS)
continue;
dp_rx_fisa_acquire_ft_lock(fisa_hdl, reo_id);
if (vdev == sw_ft_entry[i].vdev) {
dp_fisa_debug("flushing %d %pk vdev %pK", i,
&sw_ft_entry[i], vdev);
dp_rx_fisa_flush_flow_wrap(&sw_ft_entry[i]);
}
dp_rx_fisa_release_ft_lock(fisa_hdl, sw_ft_entry[i].napi_id);
dp_rx_fisa_release_ft_lock(fisa_hdl, reo_id);
}
dp_vdev_unref_delete(soc, vdev, DP_MOD_ID_RX);