samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Fix stack corruption in beacon request table mode

Browse Source 
When beacon report request is received from AP in table mode,
sme_rrm_issue_scan_req() is called recursively till scan results
in all channels for that country code is reached. In 6GHz, the
number of channels are high and recursively calling
sme_rrm_issue_scan_req for that much channels causes stack
corruption.

Remove recursive call to the function sme_rrm_issue_scan_req.
Instead, loop all the frequencies in the list and send
scan results on those channels.

Change-Id: Id75d00cfc98fcf218c6b1f85da3270e210697403
CRs-Fixed: 2654375
This commit is contained in:
Pragaspathi Thilagaraj
2020-04-01 00:57:24 +05:30
committed by nshrivas
parent 75a52a432a
commit bc52a55500
1 changed files with 30 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
core/sme/src/rrm/sme_rrm.c
View File

@@ -498,7 +498,8 @@ static QDF_STATUS sme_rrm_send_scan_result(struct mac_context *mac_ctx,
filter, &result_handle);
qdf_mem_free(filter);
sme_debug("RRM Measurement Done %d", measurementdone);
sme_debug("RRM Measurement Done %d for index:%d",
measurementdone, measurement_index);
if (!result_handle) {
/*
* no scan results
@@ -981,27 +982,36 @@ sme_rrm_issue_scan_req(struct mac_context *mac_ctx, uint8_t idx)
*/
rrm_scan_timer = 0;
freq_list = sme_rrm_ctx->channelList.freq_list;
if (!freq_list) {
sme_err("[802.11 RRM]: Global freq list is null");
sme_reset_ese_bcn_req_in_progress(sme_rrm_ctx);
status = QDF_STATUS_E_FAILURE;
goto send_ind;
}
ch_idx = sme_rrm_ctx->currentIndex;
if ((ch_idx + 1) < sme_rrm_ctx->channelList.numOfChannels) {
for (; ch_idx < sme_rrm_ctx->channelList.numOfChannels; ch_idx++) {
if ((ch_idx + 1) <
sme_rrm_ctx->channelList.numOfChannels) {
sme_rrm_send_scan_result(mac_ctx, idx, 1,
&freq_list[ch_idx], false);
&freq_list[ch_idx],
false);
/* Advance the current index. */
sme_rrm_ctx->currentIndex++;
sme_rrm_issue_scan_req(mac_ctx, idx);
#ifdef FEATURE_WLAN_ESE
sme_rrm_ctx->eseBcnReqInProgress = false;
#endif
return status;
} else {
/*
* Done with the measurement. Clean up all context and
* send a message to PE with measurement done flag set.
* Done with the measurement. Clean up all
* context and send a message to PE with
* measurement done flag set.
*/
sme_rrm_send_scan_result(mac_ctx, idx, 1,
&freq_list[ch_idx], true);
&freq_list[ch_idx],
true);
sme_reset_ese_bcn_req_in_progress(sme_rrm_ctx);
goto free_ch_lst;
}
}
}
sme_err("Unknown beacon report req mode(%d)", scan_type);
/*