A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-24 13:44:26 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge "qcacld-3.0: Add sanity check in wma_process_rmf_frame" into wlan-cld3.driver.lnx.2.0-dev

Browse source
This commit is contained in:
CNSS_WLAN Service 2017-10-20 00:02:02 -07:00 • committed by Gerrit - the friendly Code Review server
commit 575bda701e
1 changed files with 20 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

24
core/wma/src/wma_mgmt.c
View file

@ -3344,13 +3344,29 @@ int wma_process_rmf_frame(tp_wma_handle wma_handle,
rx_pkt->pkt_meta.mpdu_hdr_ptr =
qdf_nbuf_data(wbuf);
rx_pkt->pkt_meta.mpdu_len = qdf_nbuf_len(wbuf);
rx_pkt->pkt_meta.mpdu_data_len =
rx_pkt->pkt_meta.mpdu_len -
rx_pkt->pkt_meta.mpdu_hdr_len;
rx_pkt->pkt_buf = wbuf;
if (rx_pkt->pkt_meta.mpdu_len >=
rx_pkt->pkt_meta.mpdu_hdr_len) {
rx_pkt->pkt_meta.mpdu_data_len =
rx_pkt->pkt_meta.mpdu_len -
rx_pkt->pkt_meta.mpdu_hdr_len;
} else {
WMA_LOGE("mpdu len %d less than hdr %d, dropping frame",
rx_pkt->pkt_meta.mpdu_len,
rx_pkt->pkt_meta.mpdu_hdr_len);
cds_pkt_return_packet(rx_pkt);
return -EINVAL;
}
if (rx_pkt->pkt_meta.mpdu_data_len > WMA_MAX_MGMT_MPDU_LEN) {
WMA_LOGE("Data Len %d greater than max, dropping frame",
rx_pkt->pkt_meta.mpdu_data_len);
cds_pkt_return_packet(rx_pkt);
return -EINVAL;
}
rx_pkt->pkt_meta.mpdu_data_ptr =
rx_pkt->pkt_meta.mpdu_hdr_ptr +
rx_pkt->pkt_meta.mpdu_hdr_len;
rx_pkt->pkt_buf = wbuf;
WMA_LOGD(FL("BSSID: "MAC_ADDRESS_STR" tsf_delta: %u"),
MAC_ADDR_ARRAY(wh->i_addr3), rx_pkt->pkt_meta.tsf_delta);
} else {