A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 22:40:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix stack corruption issue in sme_RrmProcessNeighborReport

Browse source 
qcacld-2.0 to qcacld-3.0 propagation

When STA process Neighbor report from AP, session_id is declared
as one byte variable and its overwritten with four bytes value
in csrRoamGetSessionIdFromBSSID. This is observed on enabling stack
protection in kernel config(CONFIG_CC_STACKPROTECTOR).

Fix is to declare session_id as four bytes variable.

Git-commit: 96646d1eb48c4f3bf45555b8f636f90cf925b8b8
Change-Id: I6b2fd40a5466fe5dd72d394abb682229a550e0b1
CRs-Fixed: 1025272
This commit is contained in:
Selvaraj, Sridhar 2016-07-05 15:35:47 +05:30 • committed by Gerrit - the friendly Code Review server
commit bc950df65f
3 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
core/sme/inc/csr_internal.h
View file

@ -1309,7 +1309,7 @@ bool csr_roam_is11r_assoc(tpAniSirGlobal pMac, uint8_t sessionId);
#ifdef FEATURE_WLAN_ESE
/* Returns whether the current association is a ESE assoc or not */
bool csr_roam_is_ese_assoc(tpAniSirGlobal pMac, uint8_t sessionId);
bool csr_roam_is_ese_assoc(tpAniSirGlobal pMac, uint32_t sessionId);
bool csr_roam_is_ese_ini_feature_enabled(tpAniSirGlobal pMac);
QDF_STATUS csr_get_tsm_stats(tpAniSirGlobal pMac,
tCsrTsmStatsCallback callback,

2
core/sme/src/csr/csr_api_roam.c
View file

@ -1580,7 +1580,7 @@ QDF_STATUS csr_create_roam_scan_channel_list(tpAniSirGlobal pMac,
*
* Return: true if ese association; false otherwise
*/
bool csr_roam_is_ese_assoc(tpAniSirGlobal mac_ctx, uint8_t session_id)
bool csr_roam_is_ese_assoc(tpAniSirGlobal mac_ctx, uint32_t session_id)
{
return mac_ctx->roam.neighborRoamInfo[session_id].isESEAssoc;
}

4
core/sme/src/rrm/sme_rrm.c
View file

@ -1111,13 +1111,13 @@ QDF_STATUS sme_rrm_process_neighbor_report(tpAniSirGlobal pMac, void *pMsgBuf)
tpRrmNeighborReportDesc pNeighborReportDesc;
uint8_t i = 0;
QDF_STATUS qdf_status = QDF_STATUS_SUCCESS;
uint8_t sessionId;
uint32_t sessionId;
/* Get the session id */
status =
csr_roam_get_session_id_from_bssid(pMac,
(struct qdf_mac_addr *) pNeighborRpt->bssId,
(uint32_t *) &sessionId);
&sessionId);
if (QDF_IS_STATUS_SUCCESS(status)) {
#ifdef FEATURE_WLAN_ESE
/* Clear the cache for ESE. */