Przeglądaj źródła

qcacld-3.0: Fix regression issue for ipa init failure

When get length by HTT_WDI_IPA_OP_RESPONSE_RSP_LEN_GET,
the input msg_word needs to shift 4Bytes.
Failure length check will cause ipa uc event without processing.

Regression cause Iddf2df0fd65f5b33b54f1a608cdd34e400c0e03c.

Change-Id: I41a44ae26f84d974cbd3242f4454ec6068d7b68b
CRs-Fixed: 2206296
Jingxiang Ge 7 lat temu
rodzic
commit
0b049a8a41
1 zmienionych plików z 6 dodań i 2 usunięć
  1. 6 2
      core/dp/htt/htt_t2h.c

+ 6 - 2
core/dp/htt/htt_t2h.c

@@ -512,10 +512,14 @@ static void htt_t2h_lp_msg_handler(void *context, qdf_nbuf_t htt_t2h_msg,
 	{
 	{
 		uint16_t len;
 		uint16_t len;
 		int msg_len = qdf_nbuf_len(htt_t2h_msg);
 		int msg_len = qdf_nbuf_len(htt_t2h_msg);
-		len = HTT_WDI_IPA_OP_RESPONSE_RSP_LEN_GET(*msg_word);
+		len = HTT_WDI_IPA_OP_RESPONSE_RSP_LEN_GET(*(msg_word + 1));
 
 
 		if (sizeof(struct htt_wdi_ipa_op_response_t) + len > msg_len) {
 		if (sizeof(struct htt_wdi_ipa_op_response_t) + len > msg_len) {
-			qdf_print("Invalid buffer length");
+			qdf_print("Invalid buffer length,"
+				"sizeof(struct htt_wdi_ipa_op_response_t) %lu"
+				"len %d, msg_len %d",
+				sizeof(struct htt_wdi_ipa_op_response_t),
+				len, msg_len);
 			WARN_ON(1);
 			WARN_ON(1);
 			break;
 			break;
 		}
 		}