From ceb4d64b3e753c674fd2a717eb77edccc2d2c332 Mon Sep 17 00:00:00 2001 From: Lin Bai Date: Fri, 2 Jun 2017 11:20:44 +0800 Subject: [PATCH] qcacld-3.0: Fix fragile code in dphInitStaState qcacld-2.0 to qcacld-3.0 propagation In dphInitStaState function, it will implicitly assume that, the last member of structure tDphHashNode is *next* pointer, which is fragile and risky. Save the *next* pointer in local variant and restore after whole structure zeroed. This will need additional CPU ticks but eliminate the risk. CRs-Fixed: 2055505 Change-Id: I6baf3eddea965eda4e7f7ca88fef54709964febc --- core/mac/src/dph/dph_hash_table.c | 9 +++++---- core/mac/src/pe/lim/lim_process_tdls.c | 4 ---- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/core/mac/src/dph/dph_hash_table.c b/core/mac/src/dph/dph_hash_table.c index 3ebcb6a6d55f..3fd4940a67db 100644 --- a/core/mac/src/dph/dph_hash_table.c +++ b/core/mac/src/dph/dph_hash_table.c @@ -240,7 +240,7 @@ tpDphHashNode dph_init_sta_state(tpAniSirGlobal pMac, tSirMacAddr staAddr, { uint32_t val; - tpDphHashNode pStaDs; + tpDphHashNode pStaDs, pnext; uint16_t staIdx = STA_INVALID_IDX; if (assocId >= pDphHashTable->size) { @@ -250,10 +250,11 @@ tpDphHashNode dph_init_sta_state(tpAniSirGlobal pMac, tSirMacAddr staAddr, pStaDs = get_node(pMac, (uint8_t) assocId, pDphHashTable); staIdx = pStaDs->staIndex; + pnext = pStaDs->next; - /* Clear the STA node except for the next pointer (last 4 bytes) */ - qdf_mem_set((uint8_t *) pStaDs, - sizeof(tDphHashNode) - sizeof(tpDphHashNode), 0); + /* Clear the STA node except for the next pointer */ + qdf_mem_set((uint8_t *)pStaDs, sizeof(tDphHashNode), 0); + pStaDs->next = pnext; /* Initialize the assocId */ pStaDs->assocId = assocId; diff --git a/core/mac/src/pe/lim/lim_process_tdls.c b/core/mac/src/pe/lim/lim_process_tdls.c index f1103f7eb9f6..85d5e9b74b1c 100644 --- a/core/mac/src/pe/lim/lim_process_tdls.c +++ b/core/mac/src/pe/lim/lim_process_tdls.c @@ -2416,8 +2416,6 @@ static void lim_tdls_update_hash_node_info(tpAniSirGlobal pMac, tDot11fIEVHTCaps *pVhtCaps_txbf = NULL; tDot11fIEVHTCaps vhtCap; uint8_t cbMode; - tpDphHashNode pSessStaDs = NULL; - uint16_t aid; if (pTdlsAddStaReq->tdlsAddOper == TDLS_OPER_ADD) { populate_dot11f_ht_caps(pMac, psessionEntry, &htCap); @@ -2516,8 +2514,6 @@ static void lim_tdls_update_hash_node_info(tpAniSirGlobal pMac, else pStaDs->htSecondaryChannelOffset = cbMode; } - pSessStaDs = dph_lookup_hash_entry(pMac, psessionEntry->bssId, &aid, - &psessionEntry->dph.dphHashTable); /* Lets enable QOS parameter */ pStaDs->qosMode = (pTdlsAddStaReq->capability & CAPABILITIES_QOS_OFFSET) || pTdlsAddStaReq->htcap_present;