From bc950df65fc710c3c132ec2d3a024f22c549acce Mon Sep 17 00:00:00 2001 From: "Selvaraj, Sridhar" Date: Tue, 5 Jul 2016 15:35:47 +0530 Subject: qcacld-3.0: Fix stack corruption issue in sme_RrmProcessNeighborReport qcacld-2.0 to qcacld-3.0 propagation When STA process Neighbor report from AP, session_id is declared as one byte variable and its overwritten with four bytes value in csrRoamGetSessionIdFromBSSID. This is observed on enabling stack protection in kernel config(CONFIG_CC_STACKPROTECTOR). Fix is to declare session_id as four bytes variable. Git-commit: 96646d1eb48c4f3bf45555b8f636f90cf925b8b8 Change-Id: I6b2fd40a5466fe5dd72d394abb682229a550e0b1 CRs-Fixed: 1025272 --- core/sme/inc/csr_internal.h | 2 +- core/sme/src/csr/csr_api_roam.c | 2 +- core/sme/src/rrm/sme_rrm.c | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/core/sme/inc/csr_internal.h b/core/sme/inc/csr_internal.h index 93bd440cc4df..a8715ff2540b 100644 --- a/core/sme/inc/csr_internal.h +++ b/core/sme/inc/csr_internal.h @@ -1309,7 +1309,7 @@ bool csr_roam_is11r_assoc(tpAniSirGlobal pMac, uint8_t sessionId); #ifdef FEATURE_WLAN_ESE /* Returns whether the current association is a ESE assoc or not */ -bool csr_roam_is_ese_assoc(tpAniSirGlobal pMac, uint8_t sessionId); +bool csr_roam_is_ese_assoc(tpAniSirGlobal pMac, uint32_t sessionId); bool csr_roam_is_ese_ini_feature_enabled(tpAniSirGlobal pMac); QDF_STATUS csr_get_tsm_stats(tpAniSirGlobal pMac, tCsrTsmStatsCallback callback, diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c index 02d4a7b44c9b..54d2240c210d 100644 --- a/core/sme/src/csr/csr_api_roam.c +++ b/core/sme/src/csr/csr_api_roam.c @@ -1580,7 +1580,7 @@ QDF_STATUS csr_create_roam_scan_channel_list(tpAniSirGlobal pMac, * * Return: true if ese association; false otherwise */ -bool csr_roam_is_ese_assoc(tpAniSirGlobal mac_ctx, uint8_t session_id) +bool csr_roam_is_ese_assoc(tpAniSirGlobal mac_ctx, uint32_t session_id) { return mac_ctx->roam.neighborRoamInfo[session_id].isESEAssoc; } diff --git a/core/sme/src/rrm/sme_rrm.c b/core/sme/src/rrm/sme_rrm.c index 9570ac731800..9c25f5898228 100644 --- a/core/sme/src/rrm/sme_rrm.c +++ b/core/sme/src/rrm/sme_rrm.c @@ -1111,13 +1111,13 @@ QDF_STATUS sme_rrm_process_neighbor_report(tpAniSirGlobal pMac, void *pMsgBuf) tpRrmNeighborReportDesc pNeighborReportDesc; uint8_t i = 0; QDF_STATUS qdf_status = QDF_STATUS_SUCCESS; - uint8_t sessionId; + uint32_t sessionId; /* Get the session id */ status = csr_roam_get_session_id_from_bssid(pMac, (struct qdf_mac_addr *) pNeighborRpt->bssId, - (uint32_t *) &sessionId); + &sessionId); if (QDF_IS_STATUS_SUCCESS(status)) { #ifdef FEATURE_WLAN_ESE /* Clear the cache for ESE. */ -- cgit v1.2.3