From 414155666a34106c5bbb3a56a85045caeb52f8de Mon Sep 17 00:00:00 2001 From: Karthik Kantamneni Date: Mon, 8 Feb 2021 13:43:44 +0530 Subject: [PATCH] qcacld-3.0: Fix array out of bound access during fisa flush Fisa flow entry napi id is initialized to invalid value, which will cause out of bound access during fisa flush by vdev id. Fix this by validating array index before access. Change-Id: Ic7b1b1448194b75777f9dc392043275235caa7f7 CRs-Fixed: 2873033 --- core/dp/txrx3.0/dp_fisa_rx.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/core/dp/txrx3.0/dp_fisa_rx.c b/core/dp/txrx3.0/dp_fisa_rx.c index 284b1037c5a7..71aaa98f325d 100644 --- a/core/dp/txrx3.0/dp_fisa_rx.c +++ b/core/dp/txrx3.0/dp_fisa_rx.c @@ -1957,6 +1957,7 @@ QDF_STATUS dp_rx_fisa_flush_by_vdev_id(struct dp_soc *soc, uint8_t vdev_id) int ft_size = fisa_hdl->max_entries; int i; struct dp_vdev *vdev; + uint8_t reo_id; vdev = dp_vdev_get_ref_by_id(soc, vdev_id, DP_MOD_ID_RX); if (qdf_unlikely(!vdev)) { @@ -1965,14 +1966,17 @@ QDF_STATUS dp_rx_fisa_flush_by_vdev_id(struct dp_soc *soc, uint8_t vdev_id) } for (i = 0; i < ft_size; i++) { - dp_rx_fisa_acquire_ft_lock(fisa_hdl, sw_ft_entry[i].napi_id); + reo_id = sw_ft_entry[i].napi_id; + if (reo_id >= MAX_REO_DEST_RINGS) + continue; + dp_rx_fisa_acquire_ft_lock(fisa_hdl, reo_id); if (vdev == sw_ft_entry[i].vdev) { dp_fisa_debug("flushing %d %pk vdev %pK", i, &sw_ft_entry[i], vdev); dp_rx_fisa_flush_flow_wrap(&sw_ft_entry[i]); } - dp_rx_fisa_release_ft_lock(fisa_hdl, sw_ft_entry[i].napi_id); + dp_rx_fisa_release_ft_lock(fisa_hdl, reo_id); } dp_vdev_unref_delete(soc, vdev, DP_MOD_ID_RX);