diff options
| author | Eva Huang <evahuang@google.com> | 2021-12-06 15:21:52 +0800 |
|---|---|---|
| committer | Eva Huang <evahuang@google.com> | 2021-12-06 15:21:52 +0800 |
| commit | 2cfb55240063414f0a18950a9a91549ff3ac1e36 (patch) | |
| tree | b0e0ca31106efb9b9c43ea1f861145edd9160906 | |
| parent | f7682613e5e9ca1c1900b30a29be19d391313d9b (diff) | |
| parent | 4c53586ee1d6a1ff6a183605660c29aa2ae7eaac (diff) | |
| download | qca-wfi-host-cmn-2cfb55240063414f0a18950a9a91549ff3ac1e36.tar.gz | |
Merge branch 'android-msm-pixel-4.14-sc-security' into android-msm-pixel-4.14-sc-qpr1android-12.0.0_r0.39android-12.0.0_r0.38android-msm-sunfish-4.14-android12-qpr1android-msm-coral-4.14-android12-qpr1
Feb 2022.1
Bug: 208165756
Change-Id: Id3ad6f0f58f966ea6bf2154fb84212ccc0b6ba1f
| -rw-r--r-- | target_if/wifi_pos/src/target_if_wifi_pos.c | 13 | ||||
| -rw-r--r-- | umac/wifi_pos/src/wifi_pos_utils_i.h | 4 |
2 files changed, 15 insertions, 2 deletions
diff --git a/target_if/wifi_pos/src/target_if_wifi_pos.c b/target_if/wifi_pos/src/target_if_wifi_pos.c index f9592196e..c66050393 100644 --- a/target_if/wifi_pos/src/target_if_wifi_pos.c +++ b/target_if/wifi_pos/src/target_if_wifi_pos.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2013-2018 The Linux Foundation. All rights reserved. + * Copyright (c) 2013-2018, 2021 The Linux Foundation. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -90,6 +90,7 @@ static QDF_STATUS target_if_wifi_pos_get_indirect_data( void *paddr = NULL; uint32_t addr_hi; uint8_t ring_idx = 0, num_rings; + uint32_t allocated_len; if (!indirect) { target_if_debug("no indirect data. regular event received"); @@ -102,6 +103,16 @@ static QDF_STATUS target_if_wifi_pos_get_indirect_data( target_if_err("incorrect pdev_id: %d", indirect->pdev_id); return QDF_STATUS_E_INVAL; } + + allocated_len = priv_obj->dma_cap[ring_idx].min_buf_size + + (priv_obj->dma_cap[ring_idx].min_buf_align - 1); + if (indirect->len > allocated_len || + indirect->len > OEM_DATA_DMA_BUFF_SIZE) { + target_if_err("Invalid indirect len: %d, allocated_len:%d", + indirect->len, allocated_len); + return QDF_STATUS_E_INVAL; + } + addr_hi = (uint64_t)WMI_OEM_DMA_DATA_ADDR_HI_GET( indirect->addr_hi); paddr = (void *)((uint64_t)addr_hi << 32 | indirect->addr_lo); diff --git a/umac/wifi_pos/src/wifi_pos_utils_i.h b/umac/wifi_pos/src/wifi_pos_utils_i.h index 7172cbe9c..cfef14eaa 100644 --- a/umac/wifi_pos/src/wifi_pos_utils_i.h +++ b/umac/wifi_pos/src/wifi_pos_utils_i.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved. + * Copyright (c) 2012-2018, 2021 The Linux Foundation. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -60,6 +60,8 @@ struct wifi_pos_req_msg; #ifndef OEM_DATA_RSP_SIZE #define OEM_DATA_RSP_SIZE 1724 +/* Header + VHT80 CIR * 2 chains */ +#define OEM_DATA_DMA_BUFF_SIZE (64 + 512 * 4 * 2) #endif /** |