samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Fix static code analysis issues in DP

Browse Source 
hdr_ptr is in skb_buffer data, it's assigned with 6B array,
use uint8_t point convert to avoid SA overflow warnning.

tid has asseration protect, but need to break execute to avoid
of SA warnning

Fix use-after-free of ast_entry

Change-Id: I0835f93291cf3da2b4fd57d8c9a90f20a60c11ee
CRs-Fixed: 2751678
This commit is contained in:
Yu Tian
2020-08-10 15:51:00 +08:00
committed by snandini
parent 44150359c9
commit a1264e5fea
2 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
dp/wifi3.0/dp_rx_defrag.c
View File

@@ -1632,6 +1632,7 @@ dp_rx_defrag_store_fragment(struct dp_soc *soc,
if (tid >= DP_MAX_TIDS) { if (tid >= DP_MAX_TIDS) {
dp_info("TID out of bounds: %d", tid); dp_info("TID out of bounds: %d", tid);
qdf_assert_always(0); qdf_assert_always(0);
goto discard_frag;
} }
pdev = peer->vdev->pdev; pdev = peer->vdev->pdev;

2
dp/wifi3.0/dp_tx.c
View File

@@ -1411,7 +1411,7 @@ static void dp_tx_get_tid(struct dp_vdev *vdev, qdf_nbuf_t nbuf,
DP_TX_TID_OVERRIDE(msdu_info, nbuf); DP_TX_TID_OVERRIDE(msdu_info, nbuf);
if (qdf_likely(vdev->tx_encap_type != htt_cmn_pkt_type_raw)) { if (qdf_likely(vdev->tx_encap_type != htt_cmn_pkt_type_raw)) {
eh = (qdf_ether_header_t *)nbuf->data; eh = (qdf_ether_header_t *)nbuf->data;
hdr_ptr = eh->ether_dhost; hdr_ptr = (uint8_t *)(eh->ether_dhost);
L3datap = hdr_ptr + sizeof(qdf_ether_header_t); L3datap = hdr_ptr + sizeof(qdf_ether_header_t);
} else { } else {
qdf_dot3_qosframe_t *qos_wh = qdf_dot3_qosframe_t *qos_wh =