From c359013b266cdc1cf64c1e34253a785288f2fc5e Mon Sep 17 00:00:00 2001 From: aloksing Date: Wed, 18 Mar 2020 14:40:31 +0530 Subject: [PATCH] qcacmn: fix oob array issue Array oob due unsigned and signed compare. Release ref only if vdev id is less than num vdev. Change-Id: I9a48d7bb9f64539b4974a5323ab1df35d4bc0228 --- target_if/mlme/vdev_mgr/src/target_if_vdev_mgr_tx_ops.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/target_if/mlme/vdev_mgr/src/target_if_vdev_mgr_tx_ops.c b/target_if/mlme/vdev_mgr/src/target_if_vdev_mgr_tx_ops.c index 430075aa3d59..bb72ce1d6e62 100644 --- a/target_if/mlme/vdev_mgr/src/target_if_vdev_mgr_tx_ops.c +++ b/target_if/mlme/vdev_mgr/src/target_if_vdev_mgr_tx_ops.c @@ -877,6 +877,9 @@ static int32_t target_if_vdev_mgr_multi_vdev_restart_get_ref( psoc, wlan_vdev_get_id(tvdev)); if (!vdev_rsp) { + wlan_objmgr_vdev_release_ref(tvdev, + WLAN_VDEV_TARGET_IF_ID); + vdev_list[vdev_idx] = NULL; mlme_err("VDEV_%d PSOC_%d No vdev rsp timer", vdev_idx, wlan_psoc_get_id(psoc)); return last_vdev_idx; @@ -901,7 +904,7 @@ static void target_if_vdev_mgr_multi_vdev_restart_rel_ref( struct wlan_objmgr_psoc *psoc; struct wlan_objmgr_vdev *tvdev; struct wlan_lmac_if_mlme_rx_ops *rx_ops; - uint32_t vdev_idx; + int32_t vdev_idx; struct vdev_response_timer *vdev_rsp; psoc = wlan_pdev_get_psoc(pdev);