A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-31 12:10:52 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Update erp seq num only for FILS connection

Browse source 
During roaming, the firmware updates the host driver without
the next erp sequence number. Currently the host driver updates
the erp sequence number in roam info without checking if the
connection is FILS connection. This results in potential NULL
pointer dereference in case of non FILS connection.

Add check to see if session->pCurRoamProfile->fils_con_info is
not NULL before updating the erp sequence number.

Change-Id: I96541528d179b2b895a3f7f581e073e04bce76af
CRs-Fixed: 2405492
This commit is contained in:
Pragaspathi Thilagaraj 2019-02-26 16:30:04 +05:30 • committed by nshrivas
commit ea50d7ec8f
1 changed files with 23 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

25
core/sme/src/csr/csr_api_roam.c
View file

@ -20846,11 +20846,32 @@ static void csr_copy_fils_join_rsp_roam_info(struct csr_roam_info *roam_info,
&roam_fils_info->hlp_data_len,
roam_fils_info->hlp_data);
}
/*
* csr_update_fils_erp_seq_num() - Update the FILS erp sequence number in
* roaming profile after roam complete
* @roam_info: roam_info pointer
* @erp_next_seq_num: next erp sequence number from firmware
*
* Return: NONE
*/
static
void csr_update_fils_erp_seq_num(struct csr_roam_profile *roam_profile,
uint16_t erp_next_seq_num)
{
if (roam_profile->fils_con_info)
roam_profile->fils_con_info->sequence_number = erp_next_seq_num;
}
#else
static inline
void csr_copy_fils_join_rsp_roam_info(struct csr_roam_info *roam_info,
struct roam_offload_synch_ind *roam_synch_data)
{}
static inline
void csr_update_fils_erp_seq_num(struct csr_roam_profile *roam_profile,
uint16_t erp_next_seq_num)
{}
#endif
#ifdef WLAN_FEATURE_ROAM_OFFLOAD
@ -21213,8 +21234,8 @@ static QDF_STATUS csr_process_roam_sync_callback(struct mac_context *mac_ctx,
roam_info->update_erp_next_seq_num =
roam_synch_data->update_erp_next_seq_num;
roam_info->next_erp_seq_num = roam_synch_data->next_erp_seq_num;
session->pCurRoamProfile->fils_con_info->sequence_number =
roam_info->next_erp_seq_num;
csr_update_fils_erp_seq_num(session->pCurRoamProfile,
roam_info->next_erp_seq_num);
sme_debug("Update ERP Seq Num : %d, Next ERP Seq Num : %d",
roam_info->update_erp_next_seq_num,
roam_info->next_erp_seq_num);