A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 07:37:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Invalid rem_len computation in roam stats evt handler

Browse source 
rem_len is calculated based on MAX size of the WMI message
(WMI_SVC_MSG_MAX_SIZE) while extracting data from
WMI_ROAM_STATS_EVENTID event data.

Correct this by considering the actual message length
received in the event.

Change-Id: If24f732a8fdc0ad403e9b8a936ff8cfa0b7f7737
CRs-Fixed: 3035196
This commit is contained in:
hangtian 2021-09-23 15:12:53 +08:00 • committed by Madan Koyyalamudi
commit f1e6c20391
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
core/wma/src/wma_scan_roam.c
View file

@ -2192,7 +2192,7 @@ int wma_roam_stats_event_handler(WMA_HANDLE handle, uint8_t *event,
num_tlv = MAX_ROAM_SCAN_STATS_TLV;
}
rem_len = WMI_SVC_MSG_MAX_SIZE - sizeof(*fixed_param);
rem_len = len - sizeof(*fixed_param);
if (rem_len < num_tlv * sizeof(wmi_roam_trigger_reason)) {
wma_err_rl("Invalid roam trigger data");
goto err;