samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: fix TX completion ring NULL pointer dereference issue

Browse Source 
If IPA is enabled, index 1/2 in array soc->tx_comp_ring[] will
not be initialized, but initialize index 3/4 instead, if access
to index 1/2, NULL pointer dereference issue appeared.

use soc->num_tcl_data_rings as number of TX completion ring
wlan host interested, it differs between IPA enabled/disable case.

Change-Id: I92b4e2c9971f93136a9f4e60ae3de32140aa2477
CRs-Fixed: 3647677
This commit is contained in:
Jinwei Chen
2023-10-25 00:17:06 -07:00
committed by Ravindra Konda
parent 162ac04ff7
commit e8d518c82c
2 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
dp/wifi3.0/dp_main.c
View File

@@ -7207,9 +7207,15 @@ static inline void dp_srng_clear_ring_usage_wm_stats(struct dp_soc *soc)
hal_srng_clear_ring_usage_wm_locked(soc->hal_soc,
soc->reo_dest_ring[ring].hal_srng);
for (ring = 0; ring < soc->num_tx_comp_rings; ring++)
for (ring = 0; ring < soc->num_tcl_data_rings; ring++) {
if (wlan_cfg_get_wbm_ring_num_for_index(
soc->wlan_cfg_ctx, ring) ==
INVALID_WBM_RING_NUM)
continue;
hal_srng_clear_ring_usage_wm_locked(soc->hal_soc,
soc->tx_comp_ring[ring].hal_srng);
}
}
#else
static inline void dp_srng_clear_ring_usage_wm_stats(struct dp_soc *soc)