소스 검색

qcacmn: Do not set pkt len to HTT_MAX_MSG_SIZE in PPDU ind handling

Skbs allocated for CE1 ring are of size 2048 bytes. On
receiving PPDU stats HTT message, skb is pulled for 8
bytes corresponding to the HTC header length. As part of
dp_ppdu_stats_ind_handler, skb len is set to HTT_MAX_MSG_SIZE.
In the case where skb allocation is exactly of 2048 bytes,
including HTC header length, the aforementioned set_len
causes the skb to be expanded due to lack of tailroom.
This causes the skb data pointer to be changed which results
in invalid memory access.

Fix is to remove the qdf_nbuf_set_pktlen as skb len is
appropriately set by HTC layer.

Change-Id: Ied68c30456dc0e263ccfd03102962233a0e43d9f
CRs-Fixed: 2777516
Yeshwanth Sriram Guntuka 4 년 전
부모
커밋
fcdcc1005f
1개의 변경된 파일1개의 추가작업 그리고 1개의 파일을 삭제
  1. 1 1
      dp/wifi3.0/dp_htt.c

+ 1 - 1
dp/wifi3.0/dp_htt.c

@@ -4286,7 +4286,7 @@ dp_ppdu_stats_ind_handler(struct htt_soc *soc,
 	u_int8_t pdev_id;
 	u_int8_t target_pdev_id;
 	bool free_buf;
-	qdf_nbuf_set_pktlen(htt_t2h_msg, HTT_T2H_MAX_MSG_SIZE);
+
 	target_pdev_id = HTT_T2H_PPDU_STATS_PDEV_ID_GET(*msg_word);
 	pdev_id = dp_get_host_pdev_id_for_target_pdev_id(soc->dp_soc,
 							 target_pdev_id);