A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 16:46:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix fragile code in dphInitStaState

Browse source 
qcacld-2.0 to qcacld-3.0 propagation

In dphInitStaState function, it will implicitly assume that, the last
member of structure tDphHashNode is *next* pointer, which is fragile and
risky.

Save the *next* pointer in local variant and restore after whole
structure zeroed.
This will need additional CPU ticks but eliminate the risk.

CRs-Fixed: 2055505
Change-Id: I6baf3eddea965eda4e7f7ca88fef54709964febc
This commit is contained in:
Lin Bai 2017-06-02 11:20:44 +08:00 • committed by snandini
commit ceb4d64b3e
2 changed files with 5 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

9
core/mac/src/dph/dph_hash_table.c
View file

@ -240,7 +240,7 @@ tpDphHashNode dph_init_sta_state(tpAniSirGlobal pMac, tSirMacAddr staAddr,
{
uint32_t val;
tpDphHashNode pStaDs;
tpDphHashNode pStaDs, pnext;
uint16_t staIdx = STA_INVALID_IDX;
if (assocId >= pDphHashTable->size) {
@ -250,10 +250,11 @@ tpDphHashNode dph_init_sta_state(tpAniSirGlobal pMac, tSirMacAddr staAddr,
pStaDs = get_node(pMac, (uint8_t) assocId, pDphHashTable);
staIdx = pStaDs->staIndex;
pnext = pStaDs->next;
/* Clear the STA node except for the next pointer (last 4 bytes) */
qdf_mem_set((uint8_t *) pStaDs,
sizeof(tDphHashNode) - sizeof(tpDphHashNode), 0);
/* Clear the STA node except for the next pointer */
qdf_mem_set((uint8_t *)pStaDs, sizeof(tDphHashNode), 0);
pStaDs->next = pnext;
/* Initialize the assocId */
pStaDs->assocId = assocId;

4
core/mac/src/pe/lim/lim_process_tdls.c
View file

@ -2416,8 +2416,6 @@ static void lim_tdls_update_hash_node_info(tpAniSirGlobal pMac,
tDot11fIEVHTCaps *pVhtCaps_txbf = NULL;
tDot11fIEVHTCaps vhtCap;
uint8_t cbMode;
tpDphHashNode pSessStaDs = NULL;
uint16_t aid;
if (pTdlsAddStaReq->tdlsAddOper == TDLS_OPER_ADD) {
populate_dot11f_ht_caps(pMac, psessionEntry, &htCap);
@ -2516,8 +2514,6 @@ static void lim_tdls_update_hash_node_info(tpAniSirGlobal pMac,
else
pStaDs->htSecondaryChannelOffset = cbMode;
}
pSessStaDs = dph_lookup_hash_entry(pMac, psessionEntry->bssId, &aid,
&psessionEntry->dph.dphHashTable);
/* Lets enable QOS parameter */
pStaDs->qosMode = (pTdlsAddStaReq->capability & CAPABILITIES_QOS_OFFSET)
|| pTdlsAddStaReq->htcap_present;