diff options
| author | Rajeev Kumar <rajekuma@qca.qualcomm.com> | 2014-01-20 16:43:50 -0800 |
|---|---|---|
| committer | Prakash Dhavali <pdhavali@qca.qualcomm.com> | 2014-01-26 21:37:03 -0800 |
| commit | 58e1dba99a018cf714b01c1eee39bd0c3acbb493 (patch) | |
| tree | 170b34ad78a192650cb6e5951dd9561c936e87f2 | |
| parent | 09ba53d50fbddd7e48535a8ae325b0ba4fd224e5 (diff) | |
qcacld: Fix of page fault crash caused by garbage vdev_id
correct vdev_id is not passed to tlshim_mgmt_roam_event_ind
and since vdev_id is not passed a garbage value is taken from
stack and which led to page fault later in tlshim_mgmt_rx_proces()
Change-Id: Id2b73578e4299805db1c725a0e857c27c3bcf02c
CRs-fixed: 604727
| -rw-r--r-- | CORE/CLD_TXRX/TLSHIM/tl_shim.h | 6 | ||||
| -rw-r--r-- | CORE/SERVICES/WMA/wma.c | 3 |
2 files changed, 7 insertions, 2 deletions
diff --git a/CORE/CLD_TXRX/TLSHIM/tl_shim.h b/CORE/CLD_TXRX/TLSHIM/tl_shim.h index 3db06e786fd8..cd5813b5c6c0 100644 --- a/CORE/CLD_TXRX/TLSHIM/tl_shim.h +++ b/CORE/CLD_TXRX/TLSHIM/tl_shim.h @@ -79,4 +79,10 @@ struct deferred_iapp_work iapp_work; void WLANTL_RegisterVdev(void *vos_ctx, void *vdev); VOS_STATUS tl_shim_get_vdevid(struct ol_txrx_peer_t *peer, u_int8_t *vdev_id); +/* + * tlshim_mgmt_roam_event_ind() is called from WMA layer when + * BETTER_AP_FOUND event is received from roam engine. + */ +int tlshim_mgmt_roam_event_ind(void *context, u_int32_t vdev_id); + #endif diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c index 320874d6feb6..8679848053ed 100644 --- a/CORE/SERVICES/WMA/wma.c +++ b/CORE/SERVICES/WMA/wma.c @@ -14161,9 +14161,8 @@ static VOS_STATUS wma_tx_detach(tp_wma_handle wma_handle) */ static void wma_roam_better_ap_handler(tp_wma_handle wma, u_int32_t vdev_id) { -extern int tlshim_mgmt_roam_event_ind(void *context); VOS_STATUS ret; - ret = tlshim_mgmt_roam_event_ind(wma->vos_context); + ret = tlshim_mgmt_roam_event_ind(wma->vos_context, vdev_id); } /* function : wma_roam_event_callback |