A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 00:24:41 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix dangling pointer in WMA module

Browse source 
Pointer pointing to address which used to be start of the
mac header is no longer true after pulling the head of the frame.

Due to above situation, it causes dangling pointer situation. Fix
the error by re-assigning the correct address.

Change-Id: I71693f86b1971e3c6d1ddd9c377ef888122c2bb8
CRs-Fixed: 1048951
This commit is contained in:
Krunal Soni 2016-08-01 17:04:25 -07:00 • committed by Vishwajith Upendra
commit 54da0c6469
1 changed files with 13 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

15
core/wma/src/wma_mgmt.c
View file

@ -2934,8 +2934,13 @@ int wma_process_rmf_frame(tp_wma_handle wma_handle,
sizeof(*wh));
qdf_nbuf_pull_head(wbuf,
IEEE80211_CCMP_HEADERLEN);
qdf_nbuf_trim_tail(wbuf, IEEE80211_CCMP_MICLEN);
qdf_nbuf_trim_tail(wbuf, IEEE80211_CCMP_MICLEN);
/*
* CCMP header has been pulled off
* reinitialize the start pointer of mac header
* to avoid accessing incorrect address
*/
wh = (struct ieee80211_frame *) qdf_nbuf_data(wbuf);
rx_pkt->pkt_meta.mpdu_hdr_ptr =
qdf_nbuf_data(wbuf);
rx_pkt->pkt_meta.mpdu_len = qdf_nbuf_len(wbuf);
@ -3216,6 +3221,12 @@ static int wma_mgmt_rx_process(void *handle, uint8_t *data,
if (iface->rmfEnabled) {
status = wma_process_rmf_frame(wma_handle,
iface, wh, rx_pkt, wbuf);
/*
* CCMP header might have been pulled off
* reinitialize the start pointer of mac header
*/
wh = (struct ieee80211_frame *)
qdf_nbuf_data(wbuf);
if (status != 0)
return status;
}