Jelajahi Sumber

qcacld-3.0: Validate bw in lim calculate tpc

Currently host driver does not validate bw in lim calculate
tpc api before is it gets next higher bw, there is a possiblity
that this bw becomes invalid and driver ends up with out of bound
access for get higher bw array.

In current scenario when host driver tries to start vdev on
frequency 2472 for country IN and executes this API for frequency
2472, at the same time country is changed to US and this frequency
becomes invalid. so in the execution of this API host driver gets
invalid bw from reg set param and ends up with out of bound access
for get higher bw array.

TO address above issue, add a check to validate bw before driver
acceses get higher bw array.

Change-Id: Ibd6a2ff44a7928bb2fd461e6c49d4e306e4de7f7
CRs-Fixed: 3186084
Ashish 2 tahun lalu
induk
melakukan
8b9284cc88
1 mengubah file dengan 6 tambahan dan 3 penghapusan
  1. 6 3
      core/mac/src/pe/lim/lim_process_sme_req_messages.c

+ 6 - 3
core/mac/src/pe/lim/lim_process_sme_req_messages.c

@@ -5325,7 +5325,9 @@ void lim_calculate_tpc(struct mac_context *mac,
 
 	ch_params.ch_width = CH_WIDTH_20MHZ;
 
-	for (i = 0; i < num_pwr_levels; i++) {
+	for (i = 0;
+		i < num_pwr_levels && (ch_params.ch_width != CH_WIDTH_INVALID);
+		i++) {
 		if (is_tpe_present) {
 			if (is_6ghz_freq) {
 				wlan_reg_get_client_power_for_connecting_ap(
@@ -5343,8 +5345,9 @@ void lim_calculate_tpc(struct mac_context *mac,
 					mac->pdev, oper_freq, 0, &ch_params);
 				mlme_obj->reg_tpc_obj.frequency[i] =
 					ch_params.mhz_freq_seg0;
-				ch_params.ch_width =
-					get_next_higher_bw[ch_params.ch_width];
+				if (ch_params.ch_width != CH_WIDTH_INVALID)
+					ch_params.ch_width =
+						get_next_higher_bw[ch_params.ch_width];
 			}
 			if (is_6ghz_freq) {
 				if (LIM_IS_STA_ROLE(session)) {