qcacmn: fix invalid rx desc pool access
Only one rx desc pool is used for MCL for Rx data. Pool_id from the SW cookie is used to get the rx desc from the corresponding rx desc pool. Checking pool_id against MAX_RXDESC_POOLS may lead to kernel NULL pointer dereference Since, pool_id other than 0 is not valid for MCL. Fix this issue by checking pool_id against MAX_PDEV_CNT to get the rx desc from rx desc pool. Change-Id: Ib9b152ac2cfe2c16d388aca9e22440fbcdf7fe6c CRs-Fixed: 3244453
Esse commit está contido em:

commit de
Madan Koyyalamudi

pai
3cc8ee5529
commit
333ae2374e
@@ -545,7 +545,7 @@ struct dp_rx_desc *dp_get_rx_desc_from_cookie(struct dp_soc *soc,
|
|||||||
struct rx_desc_pool *rx_desc_pool;
|
struct rx_desc_pool *rx_desc_pool;
|
||||||
union dp_rx_desc_list_elem_t *rx_desc_elem;
|
union dp_rx_desc_list_elem_t *rx_desc_elem;
|
||||||
|
|
||||||
if (qdf_unlikely(pool_id >= MAX_RXDESC_POOLS))
|
if (qdf_unlikely(pool_id >= MAX_PDEV_CNT))
|
||||||
return NULL;
|
return NULL;
|
||||||
|
|
||||||
rx_desc_pool = &pool[pool_id];
|
rx_desc_pool = &pool[pool_id];
|
||||||
|
Referência em uma nova issue
Block a user