A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-08 21:22:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Check for following radio link stats events

Browse source 
When first WMI_RADIO_LINK_STATS_EVENTID is received radio stats buffer
is allocated based on num_radio param. There is an option for pending
following events. So update wma_unified_link_radio_stats_event_handler
to check if following events are valid wrt num_radio values to avoid
buffer overwrites.

Change-Id: If4675bada5492c3bae98c655b45cac6dc76b6431
CRs-fixed: 2309399
This commit is contained in:
Manikandan Mohan 2018-09-07 15:00:09 -07:00 • committed by nshrivas
commit 95453252fa
1 changed files with 12 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

13
core/wma/src/wma_utils.c
View file

@ -1682,6 +1682,18 @@ static int wma_unified_link_radio_stats_event_handler(void *handle,
}
}
link_stats_results = wma_handle->link_stats_results;
if (link_stats_results->num_radio == 0) {
link_stats_results->num_radio = fixed_param->num_radio;
} else if (link_stats_results->num_radio < fixed_param->num_radio) {
/*
* The link stats results size allocated based on num_radio of
* first event must be same as following events. Otherwise these
* events may be spoofed. Drop all of them and report error.
*/
WMA_LOGE("Invalid following WMI_RADIO_LINK_STATS_EVENTID. Discarding this set");
wma_unified_radio_tx_mem_free(handle);
return -EINVAL;
}
WMA_LOGD("Radio stats Fixed Param:");
WMA_LOGD("req_id: %u num_radio: %u more_radio_events: %u",
@ -1704,7 +1716,6 @@ static int wma_unified_link_radio_stats_event_handler(void *handle,
link_stats_results->paramId = WMI_LINK_STATS_RADIO;
link_stats_results->rspId = fixed_param->request_id;
link_stats_results->ifaceId = 0;
link_stats_results->num_radio = fixed_param->num_radio;
link_stats_results->peer_event_number = 0;
/*