瀏覽代碼

qcacmn: Add sanity checks before retrieving rx_desc

Add sanity checks for pool id & index extracted
from the SW cookie field within buf_addr_info.

Change-Id: Icf21b94fa05f6f8887b8c7a17896348f25436dda
CRs-Fixed: 2220030
psimha 7 年之前
父節點
當前提交
4d9c3f9806
共有 1 個文件被更改,包括 10 次插入2 次删除
  1. 10 2
      dp/wifi3.0/dp_rx.h

+ 10 - 2
dp/wifi3.0/dp_rx.h

@@ -247,8 +247,16 @@ void *dp_rx_cookie_2_va_rxdma_buf(struct dp_soc *soc, uint32_t cookie)
 {
 	uint8_t pool_id = DP_RX_DESC_COOKIE_POOL_ID_GET(cookie);
 	uint16_t index = DP_RX_DESC_COOKIE_INDEX_GET(cookie);
-	/* TODO */
-	/* Add sanity for pool_id & index */
+	struct rx_desc_pool *rx_desc_pool;
+
+	if (qdf_unlikely(pool_id >= MAX_RXDESC_POOLS))
+		return NULL;
+
+	rx_desc_pool = &soc->rx_desc_buf[pool_id];
+
+	if (qdf_unlikely(index >= rx_desc_pool->pool_size))
+		return NULL;
+
 	return &(soc->rx_desc_buf[pool_id].array[index].rx_desc);
 }