diff options
| author | Selvaraj, Sridhar <sselvara@codeaurora.org> | 2016-07-05 15:35:47 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2016-08-03 18:57:16 -0700 |
| commit | bc950df65fc710c3c132ec2d3a024f22c549acce (patch) | |
| tree | 8880372e907525b956895c0bb1b65922026e5fb3 | |
| parent | 348ed99339ef7e00d4902abfae710137ba992f55 (diff) | |
qcacld-3.0: Fix stack corruption issue in sme_RrmProcessNeighborReport
qcacld-2.0 to qcacld-3.0 propagation
When STA process Neighbor report from AP, session_id is declared
as one byte variable and its overwritten with four bytes value
in csrRoamGetSessionIdFromBSSID. This is observed on enabling stack
protection in kernel config(CONFIG_CC_STACKPROTECTOR).
Fix is to declare session_id as four bytes variable.
Git-commit: 96646d1eb48c4f3bf45555b8f636f90cf925b8b8
Change-Id: I6b2fd40a5466fe5dd72d394abb682229a550e0b1
CRs-Fixed: 1025272
| -rw-r--r-- | core/sme/inc/csr_internal.h | 2 | ||||
| -rw-r--r-- | core/sme/src/csr/csr_api_roam.c | 2 | ||||
| -rw-r--r-- | core/sme/src/rrm/sme_rrm.c | 4 |
3 files changed, 4 insertions, 4 deletions
diff --git a/core/sme/inc/csr_internal.h b/core/sme/inc/csr_internal.h index 93bd440cc4df..a8715ff2540b 100644 --- a/core/sme/inc/csr_internal.h +++ b/core/sme/inc/csr_internal.h @@ -1309,7 +1309,7 @@ bool csr_roam_is11r_assoc(tpAniSirGlobal pMac, uint8_t sessionId); #ifdef FEATURE_WLAN_ESE /* Returns whether the current association is a ESE assoc or not */ -bool csr_roam_is_ese_assoc(tpAniSirGlobal pMac, uint8_t sessionId); +bool csr_roam_is_ese_assoc(tpAniSirGlobal pMac, uint32_t sessionId); bool csr_roam_is_ese_ini_feature_enabled(tpAniSirGlobal pMac); QDF_STATUS csr_get_tsm_stats(tpAniSirGlobal pMac, tCsrTsmStatsCallback callback, diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c index 02d4a7b44c9b..54d2240c210d 100644 --- a/core/sme/src/csr/csr_api_roam.c +++ b/core/sme/src/csr/csr_api_roam.c @@ -1580,7 +1580,7 @@ QDF_STATUS csr_create_roam_scan_channel_list(tpAniSirGlobal pMac, * * Return: true if ese association; false otherwise */ -bool csr_roam_is_ese_assoc(tpAniSirGlobal mac_ctx, uint8_t session_id) +bool csr_roam_is_ese_assoc(tpAniSirGlobal mac_ctx, uint32_t session_id) { return mac_ctx->roam.neighborRoamInfo[session_id].isESEAssoc; } diff --git a/core/sme/src/rrm/sme_rrm.c b/core/sme/src/rrm/sme_rrm.c index 9570ac731800..9c25f5898228 100644 --- a/core/sme/src/rrm/sme_rrm.c +++ b/core/sme/src/rrm/sme_rrm.c @@ -1111,13 +1111,13 @@ QDF_STATUS sme_rrm_process_neighbor_report(tpAniSirGlobal pMac, void *pMsgBuf) tpRrmNeighborReportDesc pNeighborReportDesc; uint8_t i = 0; QDF_STATUS qdf_status = QDF_STATUS_SUCCESS; - uint8_t sessionId; + uint32_t sessionId; /* Get the session id */ status = csr_roam_get_session_id_from_bssid(pMac, (struct qdf_mac_addr *) pNeighborRpt->bssId, - (uint32_t *) &sessionId); + &sessionId); if (QDF_IS_STATUS_SUCCESS(status)) { #ifdef FEATURE_WLAN_ESE /* Clear the cache for ESE. */ |