Эх сурвалжийг харах

qcacmn: fix invalid rx desc pool access

Only one rx desc pool is used for MCL for Rx data. Pool_id from
the SW cookie is used to get the rx desc from the corresponding
rx desc pool. Checking pool_id against MAX_RXDESC_POOLS may lead
to kernel NULL pointer dereference Since, pool_id other than 0
is not valid for MCL.

Fix this issue by checking pool_id against MAX_PDEV_CNT
to get the rx desc from rx desc pool.

Change-Id: Ib9b152ac2cfe2c16d388aca9e22440fbcdf7fe6c
CRs-Fixed: 3244453
Venkateswara Naralasetty 3 жил өмнө
parent
commit
333ae2374e
1 өөрчлөгдсөн 1 нэмэгдсэн , 1 устгасан
  1. 1 1
      dp/wifi3.0/dp_rx.h

+ 1 - 1
dp/wifi3.0/dp_rx.h

@@ -545,7 +545,7 @@ struct dp_rx_desc *dp_get_rx_desc_from_cookie(struct dp_soc *soc,
 	struct rx_desc_pool *rx_desc_pool;
 	union dp_rx_desc_list_elem_t *rx_desc_elem;
 
-	if (qdf_unlikely(pool_id >= MAX_RXDESC_POOLS))
+	if (qdf_unlikely(pool_id >= MAX_PDEV_CNT))
 		return NULL;
 
 	rx_desc_pool = &pool[pool_id];