samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: fix invalid rx desc pool access

Browse Source 
Only one rx desc pool is used for MCL for Rx data. Pool_id from
the SW cookie is used to get the rx desc from the corresponding
rx desc pool. Checking pool_id against MAX_RXDESC_POOLS may lead
to kernel NULL pointer dereference Since, pool_id other than 0
is not valid for MCL.

Fix this issue by checking pool_id against MAX_PDEV_CNT
to get the rx desc from rx desc pool.

Change-Id: Ib9b152ac2cfe2c16d388aca9e22440fbcdf7fe6c
CRs-Fixed: 3244453
This commit is contained in:
Venkateswara Naralasetty
2022-07-15 11:27:44 +05:30
committed by Madan Koyyalamudi
parent 3cc8ee5529
commit 333ae2374e
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
dp/wifi3.0/dp_rx.h
View File

@@ -545,7 +545,7 @@ struct dp_rx_desc *dp_get_rx_desc_from_cookie(struct dp_soc *soc,
struct rx_desc_pool *rx_desc_pool;
union dp_rx_desc_list_elem_t *rx_desc_elem;
if (qdf_unlikely(pool_id >= MAX_RXDESC_POOLS))
if (qdf_unlikely(pool_id >= MAX_PDEV_CNT))
return NULL;
rx_desc_pool = &pool[pool_id];