samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: fix oob array issue

Browse Source 
Array oob due unsigned and signed compare.
Release ref only if vdev id is less than num vdev.

Change-Id: I9a48d7bb9f64539b4974a5323ab1df35d4bc0228
This commit is contained in:
aloksing
2020-03-18 14:40:31 +05:30
committed by nshrivas
parent 6c92dfdcf0
commit c359013b26
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
target_if/mlme/vdev_mgr/src/target_if_vdev_mgr_tx_ops.c
View File

@@ -877,6 +877,9 @@ static int32_t target_if_vdev_mgr_multi_vdev_restart_get_ref(
psoc, psoc,
wlan_vdev_get_id(tvdev)); wlan_vdev_get_id(tvdev));
if (!vdev_rsp) { if (!vdev_rsp) {
wlan_objmgr_vdev_release_ref(tvdev,
WLAN_VDEV_TARGET_IF_ID);
vdev_list[vdev_idx] = NULL;
mlme_err("VDEV_%d PSOC_%d No vdev rsp timer", mlme_err("VDEV_%d PSOC_%d No vdev rsp timer",
vdev_idx, wlan_psoc_get_id(psoc)); vdev_idx, wlan_psoc_get_id(psoc));
return last_vdev_idx; return last_vdev_idx;
@@ -901,7 +904,7 @@ static void target_if_vdev_mgr_multi_vdev_restart_rel_ref(
struct wlan_objmgr_psoc *psoc; struct wlan_objmgr_psoc *psoc;
struct wlan_objmgr_vdev *tvdev; struct wlan_objmgr_vdev *tvdev;
struct wlan_lmac_if_mlme_rx_ops *rx_ops; struct wlan_lmac_if_mlme_rx_ops *rx_ops;
uint32_t vdev_idx; int32_t vdev_idx;
struct vdev_response_timer *vdev_rsp; struct vdev_response_timer *vdev_rsp;
psoc = wlan_pdev_get_psoc(pdev); psoc = wlan_pdev_get_psoc(pdev);