From fed91e16d8019d54b98c0b999126456d2d172ef8 Mon Sep 17 00:00:00 2001 From: Surya Prakash Sivaraj Date: Thu, 28 Apr 2022 15:25:15 +0530 Subject: [PATCH] qcacld-3.0: Validate bw in lim calculate tpc Currently host driver does not validate bw in lim calculate tpc api before is it gets next higher bw, there is a possiblity that this bw becomes invalid and driver ends up with out of bound access for get higher bw array. In current scenario when host driver tries to start vdev on frequency 2472 for country IN and executes this API for frequency 2472, at the same time country is changed to US and this frequency becomes invalid. so in the execution of this API host driver gets invalid bw from reg set param and ends up with out of bound access for get higher bw array. TO address above issue, add a check to validate bw before driver acceses get higher bw array. Change-Id: Ibd6a2ff44a7928bb2fd461e6c49d4e306e4de7f7 CRs-Fixed: 3186084 --- core/mac/src/pe/lim/lim_process_sme_req_messages.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/core/mac/src/pe/lim/lim_process_sme_req_messages.c b/core/mac/src/pe/lim/lim_process_sme_req_messages.c index 49113c9529e4..41842fe17ead 100644 --- a/core/mac/src/pe/lim/lim_process_sme_req_messages.c +++ b/core/mac/src/pe/lim/lim_process_sme_req_messages.c @@ -1,6 +1,6 @@ /* * Copyright (c) 2012-2020 The Linux Foundation. All rights reserved. - * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -2223,7 +2223,9 @@ void lim_calculate_tpc(struct mac_context *mac, ch_params.ch_width = CH_WIDTH_20MHZ; - for (i = 0; i < num_pwr_levels; i++) { + for (i = 0; + i < num_pwr_levels && (ch_params.ch_width != CH_WIDTH_INVALID); + i++) { if (is_tpe_present) { if (is_6ghz_freq) { wlan_reg_get_client_power_for_connecting_ap( @@ -2241,8 +2243,9 @@ void lim_calculate_tpc(struct mac_context *mac, mac->pdev, oper_freq, 0, &ch_params); mlme_obj->reg_tpc_obj.frequency[i] = ch_params.mhz_freq_seg0; - ch_params.ch_width = - get_next_higher_bw[ch_params.ch_width]; + if (ch_params.ch_width != CH_WIDTH_INVALID) + ch_params.ch_width = + get_next_higher_bw[ch_params.ch_width]; } if (is_6ghz_freq) { if (LIM_IS_STA_ROLE(session)) {