A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-26 06:33:19 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Add boundary check for next twt size

Browse source 
Next twt size values can be 0 to 3. Add boundary check
for next twt size.

CRs-Fixed: 2786224
Change-Id: I2ee0a1ffcf3f2227ca2e3daed7069326992bc15a
This commit is contained in:
Rajasekaran Kalidoss 2020-09-26 22:02:21 +05:30 • committed by snandini
commit 7baa7b0782
2 changed files with 8 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

5
core/hdd/src/wlan_hdd_cfg80211.h
View file

@ -209,11 +209,6 @@ extern const struct nla_policy wlan_hdd_wisa_cmd_policy[
#define USE_CFG80211_DEL_STA_V2
#endif
#define TWT_SETUP_WAKE_INTVL_MANTISSA_MAX 0xFFFF
#define TWT_SETUP_WAKE_DURATION_MAX 0xFFFF
#define TWT_SETUP_WAKE_INTVL_EXP_MAX 31
#define TWT_WAKE_DURATION_MULTIPLICATION_FACTOR 256
/**
* enum eDFS_CAC_STATUS: CAC status
*

8
core/hdd/src/wlan_hdd_twt.c
View file

@ -44,6 +44,12 @@
#define TWT_FLOW_TYPE_ANNOUNCED 0
#define TWT_FLOW_TYPE_UNANNOUNCED 1
#define TWT_SETUP_WAKE_INTVL_MANTISSA_MAX 0xFFFF
#define TWT_SETUP_WAKE_DURATION_MAX 0xFFFF
#define TWT_SETUP_WAKE_INTVL_EXP_MAX 31
#define TWT_WAKE_DURATION_MULTIPLICATION_FACTOR 256
#define TWT_MAX_NEXT_TWT_SIZE 3
/**
* struct twt_pause_dialog_comp_ev_priv - private struct for twt pause dialog
* @pause_dialog_comp_ev_buf: buffer from TWT pause dialog complete_event
@ -1843,6 +1849,8 @@ static int hdd_twt_resume_session(struct hdd_adapter *adapter,
hdd_err_rl("TWT_RESUME NEXT_TWT_SIZE is must");
return -EINVAL;
}
if (params.next_twt_size > TWT_MAX_NEXT_TWT_SIZE)
return -EINVAL;
hdd_debug("twt_resume: vdev_id %d dialog_id %d peer mac_addr "
QDF_MAC_ADDR_FMT, params.vdev_id, params.dialog_id,