Browse Source

qcacld-3.0: Fix callback function type for cds_ol_rx_thread_cb

To address kernel control flow integrity (CFI) issues related to
type mismatch, correct input argument type for ol_rx_data_cb().

Change-Id: Iafefe5dc3d946e3d67743de1a662aa3b0511cf5d
CRs-Fixed: 2407160
Alok Kumar 6 years ago
parent
commit
ea3b23bc74
2 changed files with 31 additions and 14 deletions
  1. 4 2
      core/cds/inc/cds_sched.h
  2. 27 12
      core/dp/txrx/ol_txrx.c

+ 4 - 2
core/cds/inc/cds_sched.h

@@ -55,7 +55,9 @@
 #define CDS_MAX_OL_RX_PKT 4000
 #endif
 
-typedef void (*cds_ol_rx_thread_cb)(void *context, void *rxpkt, uint16_t staid);
+typedef void (*cds_ol_rx_thread_cb)(void *context,
+				    qdf_nbuf_t rxpkt,
+				    uint16_t staid);
 
 /*
 ** CDS message wrapper for data rx from TXRX
@@ -65,7 +67,7 @@ struct cds_ol_rx_pkt {
 	void *context;
 
 	/* Rx skb */
-	void *Rxpkt;
+	qdf_nbuf_t Rxpkt;
 
 	/* Station id to which this packet is destined */
 	uint16_t staId;

+ 27 - 12
core/dp/txrx/ol_txrx.c

@@ -4513,15 +4513,15 @@ static inline int ol_txrx_drop_nbuf_list(qdf_nbuf_t buf_list)
 }
 
 /**
- * ol_rx_data_cb() - data rx callback
- * @peer: peer
+ * ol_rx_data_handler() - data rx handler
+ * @pdev: dev handle
  * @buf_list: buffer list
  * @staid: Station id
  *
  * Return: None
  */
-static void ol_rx_data_cb(struct ol_txrx_pdev_t *pdev,
-			  qdf_nbuf_t buf_list, uint16_t staid)
+static void ol_rx_data_handler(struct ol_txrx_pdev_t *pdev,
+			       qdf_nbuf_t buf_list, uint16_t staid)
 {
 	void *osif_dev;
 	uint8_t drop_count = 0;
@@ -4583,6 +4583,22 @@ free_buf:
 	ol_txrx_warn("Dropped frames %u", drop_count);
 }
 
+/**
+ * ol_rx_data_cb() - data rx callback
+ * @context: dev handle
+ * @buf_list: buffer list
+ * @staid: Station id
+ *
+ * Return: None
+ */
+static inline void
+ol_rx_data_cb(void *context, qdf_nbuf_t buf_list, uint16_t staid)
+{
+	struct ol_txrx_pdev_t *pdev = context;
+
+	ol_rx_data_handler(pdev, buf_list, staid);
+}
+
 /* print for every 16th packet */
 #define OL_TXRX_PRINT_RATE_LIMIT_THRESH 0x0f
 struct ol_rx_cached_buf *cache_buf;
@@ -4707,7 +4723,7 @@ void ol_rx_data_process(struct ol_txrx_peer_t *peer,
 		 * better use multicores.
 		 */
 		if (!ol_cfg_is_rx_thread_enabled(pdev->ctrl_pdev)) {
-			ol_rx_data_cb(pdev, rx_buf_list, peer->local_id);
+			ol_rx_data_handler(pdev, rx_buf_list, peer->local_id);
 		} else {
 			p_cds_sched_context sched_ctx =
 				get_cds_sched_ctxt();
@@ -4720,15 +4736,14 @@ void ol_rx_data_process(struct ol_txrx_peer_t *peer,
 			if (!pkt)
 				goto drop_rx_buf;
 
-			pkt->callback = (cds_ol_rx_thread_cb)
-					ol_rx_data_cb;
-			pkt->context = (void *)pdev;
-			pkt->Rxpkt = (void *)rx_buf_list;
+			pkt->callback = ol_rx_data_cb;
+			pkt->context = pdev;
+			pkt->Rxpkt = rx_buf_list;
 			pkt->staId = peer->local_id;
 			cds_indicate_rxpkt(sched_ctx, pkt);
 		}
 #else                           /* QCA_CONFIG_SMP */
-		ol_rx_data_cb(pdev, rx_buf_list, peer->local_id);
+		ol_rx_data_handler(pdev, rx_buf_list, peer->local_id);
 #endif /* QCA_CONFIG_SMP */
 	}
 
@@ -4879,8 +4894,8 @@ exit:
  * Return: none
  */
 static void ol_txrx_offld_flush_handler(void *context,
-				      void *rxpkt,
-				      uint16_t staid)
+					qdf_nbuf_t rxpkt,
+					uint16_t staid)
 {
 	ol_txrx_pdev_handle pdev = cds_get_context(QDF_MODULE_ID_TXRX);