Ver Fonte

qcacmn: Fix the parsing of current pn in REO error path

The current PN is a 128-bit field which was incorrectly
stored into a 64-bit variable, leading to stack corruption.

Fix this by increasing the size of the variable
for current PN to 128-bits.

Change-Id: Ib26cc0bb7d244360afb258a55d5b9a8ddd6aa4ca
CRs-Fixed: 3059345
Rakesh Pillai há 3 anos atrás
pai
commit
c634e23cf7
1 ficheiros alterados com 3 adições e 3 exclusões
  1. 3 3
      dp/wifi3.0/dp_rx_err.c

+ 3 - 3
dp/wifi3.0/dp_rx_err.c

@@ -535,12 +535,12 @@ static inline QDF_STATUS
 dp_rx_err_nbuf_pn_check(struct dp_soc *soc, hal_ring_desc_t ring_desc,
 			qdf_nbuf_t nbuf)
 {
-	uint64_t prev_pn, curr_pn;
+	uint64_t prev_pn, curr_pn[2];
 
 	hal_rx_reo_prev_pn_get(soc->hal_soc, ring_desc, &prev_pn);
-	hal_rx_tlv_get_pn_num(soc->hal_soc, qdf_nbuf_data(nbuf), &curr_pn);
+	hal_rx_tlv_get_pn_num(soc->hal_soc, qdf_nbuf_data(nbuf), curr_pn);
 
-	if (curr_pn > prev_pn)
+	if (curr_pn[0] > prev_pn)
 		return QDF_STATUS_SUCCESS;
 
 	return QDF_STATUS_E_FAILURE;