A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 15:11:48 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: fix oob array issue

Browse source 
Array oob due unsigned and signed compare.
Release ref only if vdev id is less than num vdev.

Change-Id: I9a48d7bb9f64539b4974a5323ab1df35d4bc0228
This commit is contained in:
aloksing 2020-03-18 14:40:31 +05:30 • committed by nshrivas
commit c359013b26
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
target_if/mlme/vdev_mgr/src/target_if_vdev_mgr_tx_ops.c
View file

@ -877,6 +877,9 @@ static int32_t target_if_vdev_mgr_multi_vdev_restart_get_ref(
psoc,
wlan_vdev_get_id(tvdev));
if (!vdev_rsp) {
wlan_objmgr_vdev_release_ref(tvdev,
WLAN_VDEV_TARGET_IF_ID);
vdev_list[vdev_idx] = NULL;
mlme_err("VDEV_%d PSOC_%d No vdev rsp timer",
vdev_idx, wlan_psoc_get_id(psoc));
return last_vdev_idx;
@ -901,7 +904,7 @@ static void target_if_vdev_mgr_multi_vdev_restart_rel_ref(
struct wlan_objmgr_psoc *psoc;
struct wlan_objmgr_vdev *tvdev;
struct wlan_lmac_if_mlme_rx_ops *rx_ops;
uint32_t vdev_idx;
int32_t vdev_idx;
struct vdev_response_timer *vdev_rsp;
psoc = wlan_pdev_get_psoc(pdev);