浏览代码

qcacld-3.0: Reset memory allocation of BSS description

qcacld-2.0 to qcacld-3.0 propagation

In CCX, BSS description is sent as part of beacon report. If BSS
description has random values, it leads to CCX certification failure.
Fix this by resetting memory allocated with zero. Also, reset memory
allocated to send beacon report to avoid this issue.

Change-Id: I445942b64ca9f382f8d24ca19665d6bda2341a80
CRs-Fixed: 931441
(cherry picked from commit c7a96bbd498d6d096f1dcade7fce0f6c1732248e)
Padma, Santhosh Kumar 9 年之前
父节点
当前提交
17fac9f9c5
共有 2 个文件被更改,包括 7 次插入3 次删除
  1. 3 0
      core/mac/src/pe/lim/lim_scan_result_utils.c
  2. 4 3
      core/sme/src/rrm/sme_rrm.c

+ 3 - 0
core/mac/src/pe/lim/lim_scan_result_utils.c

@@ -388,6 +388,9 @@ lim_check_and_add_bss_description(tpAniSirGlobal mac_ctx,
 			FL("qdf_mem_malloc(length=%d) failed"), frame_len);
 		return;
 	}
+
+	qdf_mem_zero(bssdescr, frame_len);
+
 	/* In scan state, store scan result. */
 	lim_collect_bss_description(mac_ctx, bssdescr, bpr, rx_packet_info,
 				    scanning);

+ 4 - 3
core/sme/src/rrm/sme_rrm.c

@@ -172,7 +172,7 @@ sme_rrm_send_beacon_report_xmit_ind(tpAniSirGlobal mac_ctx,
 {
 	tpSirBssDescription bss_desc = NULL;
 	tpSirBeaconReportXmitInd beacon_rep;
-	uint16_t length, ie_len;
+	uint16_t length, ie_len, tot_len;
 	uint8_t  i = 0, j = 0;
 	tCsrScanResultInfo *cur_result = NULL;
 	QDF_STATUS status = QDF_STATUS_E_FAILURE;
@@ -209,12 +209,13 @@ sme_rrm_send_beacon_report_xmit_ind(tpAniSirGlobal mac_ctx,
 			if (bss_desc == NULL)
 				break;
 			ie_len = GET_IE_LEN_IN_BSS(bss_desc->length);
+			tot_len = ie_len + sizeof(*bss_desc);
 			beacon_rep->pBssDescription[i] =
-				qdf_mem_malloc(ie_len +
-					sizeof(tSirBssDescription));
+				qdf_mem_malloc(tot_len);
 			if (NULL ==
 				beacon_rep->pBssDescription[i])
 				break;
+			qdf_mem_zero(beacon_rep->pBssDescription[i], tot_len);
 			qdf_mem_copy(beacon_rep->pBssDescription[i],
 				bss_desc, sizeof(tSirBssDescription));
 			qdf_mem_copy(