A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix RRM beacon report generation

Browse source 
rrm_process_beacon_report_xmit() fills the local structure on stack
but does not copy it to allocated frame buffer. Modified the code
to use a pointer to that report in the buffer.

CRs-Fixed: 1058403
Change-Id: If0c825febc1e2000e46786edfca96b0959626eaa
This commit is contained in:
Deepak Dhamdhere 2016-08-23 14:29:45 -07:00 • committed by Gerrit - the friendly Code Review server
commit 6aa33ba7db
1 changed files with 17 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

34
core/mac/src/pe/rrm/rrm_api.c
View file

@ -795,7 +795,7 @@ rrm_process_beacon_report_xmit(tpAniSirGlobal mac_ctx,
{
tSirRetStatus status = eSIR_SUCCESS;
tSirMacRadioMeasureReport *report = NULL;
tSirMacBeaconReport beacon_report;
tSirMacBeaconReport *beacon_report;
tpSirBssDescription bss_desc;
tpRRMReq curr_req = mac_ctx->rrm.rrmPEContext.pCurrentReq;
tpPESession session_entry;
@ -842,7 +842,7 @@ rrm_process_beacon_report_xmit(tpAniSirGlobal mac_ctx,
for (bss_desc_count = 0; bss_desc_count <
beacon_xmit_ind->numBssDesc; bss_desc_count++) {
beacon_report =
report[bss_desc_count].report.beaconReport;
&report[bss_desc_count].report.beaconReport;
/*
* If the scan result is NULL then send report request
* with option subelement as NULL.
@ -862,21 +862,21 @@ rrm_process_beacon_report_xmit(tpAniSirGlobal mac_ctx,
*/
if (beacon_xmit_ind->length < sizeof(*beacon_xmit_ind))
continue;
beacon_report.regClass = beacon_xmit_ind->regClass;
beacon_report->regClass = beacon_xmit_ind->regClass;
if (bss_desc) {
beacon_report.channel = bss_desc->channelId;
qdf_mem_copy(beacon_report.measStartTime,
beacon_report->channel = bss_desc->channelId;
qdf_mem_copy(beacon_report->measStartTime,
bss_desc->startTSF,
sizeof(bss_desc->startTSF));
beacon_report.measDuration =
beacon_report->measDuration =
SYS_MS_TO_TU(beacon_xmit_ind->duration);
beacon_report.phyType = bss_desc->nwType;
beacon_report.bcnProbeRsp = 1;
beacon_report.rsni = bss_desc->sinr;
beacon_report.rcpi = bss_desc->rssi;
beacon_report.antennaId = 0;
beacon_report.parentTSF = bss_desc->parentTSF;
qdf_mem_copy(beacon_report.bssid,
beacon_report->phyType = bss_desc->nwType;
beacon_report->bcnProbeRsp = 1;
beacon_report->rsni = bss_desc->sinr;
beacon_report->rcpi = bss_desc->rssi;
beacon_report->antennaId = 0;
beacon_report->parentTSF = bss_desc->parentTSF;
qdf_mem_copy(beacon_report->bssid,
bss_desc->bssId, sizeof(tSirMacAddr));
}
@ -893,8 +893,8 @@ rrm_process_beacon_report_xmit(tpAniSirGlobal mac_ctx,
if (bss_desc) {
rrm_fill_beacon_ies(mac_ctx,
(uint8_t *) &beacon_report.Ies[0],
(uint8_t *) &beacon_report.numIes,
(uint8_t *) &beacon_report->Ies[0],
(uint8_t *) &beacon_report->numIes,
BEACON_REPORT_MAX_IES,
curr_req->request.Beacon.reqIes.
pElementIds,
@ -908,8 +908,8 @@ rrm_process_beacon_report_xmit(tpAniSirGlobal mac_ctx,
lim_log(mac_ctx, LOG3, FL("Default all IEs and FFs"));
if (bss_desc) {
rrm_fill_beacon_ies(mac_ctx,
(uint8_t *) &beacon_report.Ies[0],
(uint8_t *) &beacon_report.numIes,
(uint8_t *) &beacon_report->Ies[0],
(uint8_t *) &beacon_report->numIes,
BEACON_REPORT_MAX_IES,
NULL,
0,