A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 08:36:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix stability issue observed in set channel request

Browse source 
Fix array out-of-bounds access while populating the BSS rate set.
The issue was seen while populating the basic supported rate
and extended rate sets.

CRs-Fixed: 2081423
Change-Id: I8626399b7f9a04dc368daa582b6a09500a7ea015
This commit is contained in:
Ravi Joshi 2017-07-18 17:55:21 -07:00 • committed by snandini
commit b398c85774
1 changed files with 20 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

21
core/sme/src/csr/csr_api_roam.c
View file

@ -12952,6 +12952,16 @@ static void csr_merge_supported_and_extended_rates(
{
int i;
QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_DEBUG,
FL("supported_rates: %d extended_rates: %d"),
supported_rates->numRates, extended_rates->numRates);
if (supported_rates->numRates > SIR_MAC_RATESET_EID_MAX)
supported_rates->numRates = SIR_MAC_RATESET_EID_MAX;
if (extended_rates->numRates > SIR_MAC_RATESET_EID_MAX)
extended_rates->numRates = SIR_MAC_RATESET_EID_MAX;
qdf_mem_copy(rates->rate,
supported_rates->rate,
supported_rates->numRates);
@ -13137,12 +13147,18 @@ csr_roam_get_bss_start_parms(tpAniSirGlobal pMac,
opr_ch = tmp_opr_ch;
break;
}
pParam->operationChn = opr_ch;
pParam->operationChn = opr_ch;
if (pProfile->supported_rates.numRates ||
pProfile->extended_rates.numRates) {
struct merged_mac_rate_set rates_driver, rates_hostapd;
qdf_mem_zero(&rates_driver,
sizeof(struct merged_mac_rate_set));
qdf_mem_zero(&rates_hostapd,
sizeof(struct merged_mac_rate_set));
QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_DEBUG,
"Merge rates driver");
csr_merge_supported_and_extended_rates(&rates_driver,
@ -18772,7 +18788,10 @@ QDF_STATUS csr_roam_channel_change_req(tpAniSirGlobal pMac,
* give us rates based on original channel which may not be
* suitable for new channel
*/
qdf_mem_zero(&param, sizeof(tCsrRoamStartBssParams));
csr_roam_get_bss_start_parms(pMac, profile, &param, true);
pMsg = qdf_mem_malloc(sizeof(tSirChanChangeRequest));
if (!pMsg)
return QDF_STATUS_E_NOMEM;