samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: add NULL check and drop rx indication for a frame

Browse Source 
qcacld-2.0 to qcacld-3.0 propagation

Add check to handle kernel NULL pointer dereference
during calling ol_rx_reorder_release.

Change-Id: If0367e0a7910d7ee460709fc8ae25ecc6de3485d
CRs-Fixed: 994435
This commit is contained in:
Poddar, Siddarth
2016-05-02 12:05:11 +05:30
committed by qcabuildsw
parent ff89f748c1
commit 0cec8eaf67
1 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
core/dp/txrx/ol_rx_reorder.c
View File

@@ -82,7 +82,6 @@ static char g_log2ceil[] = {
/*---*/
/* reorder array elements are known to be non-NULL */
#define OL_RX_REORDER_PTR_CHECK(ptr) /* no-op */
#define OL_RX_REORDER_LIST_APPEND(head_msdu, tail_msdu, rx_reorder_array_elem) \
do { \
if (tail_msdu) { \
@@ -262,15 +261,14 @@ ol_rx_reorder_release(struct ol_txrx_vdev_t *vdev,
head_msdu = rx_reorder_array_elem->head;
tail_msdu = rx_reorder_array_elem->tail;
rx_reorder_array_elem->head = rx_reorder_array_elem->tail = NULL;
OL_RX_REORDER_PTR_CHECK(head_msdu) {
if (head_msdu)
OL_RX_REORDER_MPDU_CNT_DECR(&peer->tids_rx_reorder[tid], 1);
}
idx = (idx_start + 1);
OL_RX_REORDER_IDX_WRAP(idx, win_sz, win_sz_mask);
while (idx != idx_end) {
rx_reorder_array_elem = &peer->tids_rx_reorder[tid].array[idx];
OL_RX_REORDER_PTR_CHECK(rx_reorder_array_elem->head) {
if (rx_reorder_array_elem->head) {
OL_RX_REORDER_MPDU_CNT_DECR(&peer->tids_rx_reorder[tid],
1);
OL_RX_REORDER_LIST_APPEND(head_msdu, tail_msdu,
@@ -282,7 +280,7 @@ ol_rx_reorder_release(struct ol_txrx_vdev_t *vdev,
idx++;
OL_RX_REORDER_IDX_WRAP(idx, win_sz, win_sz_mask);
}
OL_RX_REORDER_PTR_CHECK(head_msdu) {
if (head_msdu) {
uint16_t seq_num;
htt_pdev_handle htt_pdev = vdev->pdev->htt_pdev;