samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: fix index overflow when tso seg large

Browse Source 
In some cases, TSO segment may larger than 255.
If use uint8 as the loop index, tx logic will
overflow and sending the last segment repeatly,
then lead to buffer double free. Change index
variable to uint32

CRs-Fixed: 2722918

Change-Id: I156a5d8b8a3895e4f7bfc53cf5561f51ca8b06ca
This commit is contained in:
Yu Tian
2020-07-03 11:27:20 +08:00
committed by nshrivas
parent b1a2f9fbad
commit 0b0c3e3c7a
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
dp/wifi3.0/dp_tx.c
View File

@@ -1790,7 +1790,7 @@ noinline
qdf_nbuf_t dp_tx_send_msdu_multiple(struct dp_vdev *vdev, qdf_nbuf_t nbuf,
struct dp_tx_msdu_info_s *msdu_info)
{
uint8_t i;
uint32_t i;
struct dp_pdev *pdev = vdev->pdev;
struct dp_soc *soc = pdev->soc;
struct dp_tx_desc_s *tx_desc;