From 6d0a7569581368017c118fc3b7cebfee2dc37bd0 Mon Sep 17 00:00:00 2001 From: Yeshwanth Sriram Guntuka Date: Wed, 8 May 2019 15:16:07 +0530 Subject: qcacmn: Fix potential double free in send_log_supported_evt_cmd_tlv In send_log_supported_evt_cmd_tlv, events_logs_list in wma handle is freed if previously allocated. If the num_of_diag_events_logs exceeds the max size, we exit from the function early without allocating memory for events_logs_list. This can result in potential double free scenario if we receive another DIAG_EVENT_LOG_SUPPORTED event from firmware. Fix is to set events_logs_list pointer to NULL after freeing memory. Change-Id: I9d6148dfc064d87e2947d1b5ec4492c08913dd4c CRs-Fixed: 2433802 --- wmi/src/wmi_unified_tlv.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 95286ee66ad4..d4e59f7e9036 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -10893,8 +10893,10 @@ QDF_STATUS send_log_supported_evt_cmd_tlv(wmi_unified_t wmi_handle, __func__, num_of_diag_events_logs); /* Free any previous allocation */ - if (wmi_handle->events_logs_list) + if (wmi_handle->events_logs_list) { qdf_mem_free(wmi_handle->events_logs_list); + wmi_handle->events_logs_list = NULL; + } if (num_of_diag_events_logs > (WMI_SVC_MSG_MAX_SIZE / sizeof(uint32_t))) { -- cgit v1.2.3 From 3513ddb9467959d6dcf63830821fe3aa193da1c3 Mon Sep 17 00:00:00 2001 From: Debasis Das Date: Wed, 4 Apr 2018 17:17:55 +0530 Subject: qcacmn: Fix Integer Overflow Leading to Buffer Overflow wmi_buf_alloc() API expects length to be passed of type uint16_t. However, the callers pass uint32_t to it. This might result in overflow and illegal memory access thereafter. The fix is to modify the API signature accordingly. Change-Id: If09da4978d421269b884f7d3c933c49c81651475 CRs-Fixed: 2218346 --- wmi/inc/wmi_unified_api.h | 6 +++--- wmi/src/wmi_unified.c | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/wmi/inc/wmi_unified_api.h b/wmi/inc/wmi_unified_api.h index 14611e10ec5a..3c57cdc09cea 100644 --- a/wmi/inc/wmi_unified_api.h +++ b/wmi/inc/wmi_unified_api.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2013-2019 The Linux Foundation. All rights reserved. + * Copyright (c) 2013-2020 The Linux Foundation. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -138,10 +138,10 @@ wmi_unified_remove_work(struct wmi_unified *wmi_handle); #ifdef MEMORY_DEBUG #define wmi_buf_alloc(h, l) wmi_buf_alloc_debug(h, l, __FILE__, __LINE__) wmi_buf_t -wmi_buf_alloc_debug(wmi_unified_t wmi_handle, uint16_t len, +wmi_buf_alloc_debug(wmi_unified_t wmi_handle, uint32_t len, uint8_t *file_name, uint32_t line_num); #else -wmi_buf_t wmi_buf_alloc(wmi_unified_t wmi_handle, uint16_t len); +wmi_buf_t wmi_buf_alloc(wmi_unified_t wmi_handle, uint32_t len); #endif /** diff --git a/wmi/src/wmi_unified.c b/wmi/src/wmi_unified.c index 9aa0a8b0faad..2123435149e4 100644 --- a/wmi/src/wmi_unified.c +++ b/wmi/src/wmi_unified.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2015-2018 The Linux Foundation. All rights reserved. + * Copyright (c) 2015-2018,2020 The Linux Foundation. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -1201,8 +1201,8 @@ int wmi_get_host_credits(wmi_unified_t wmi_handle); #ifdef MEMORY_DEBUG wmi_buf_t -wmi_buf_alloc_debug(wmi_unified_t wmi_handle, uint16_t len, uint8_t *file_name, - uint32_t line_num) +wmi_buf_alloc_debug(wmi_unified_t wmi_handle, uint32_t len, uint8_t *file_name, + uint32_t line_num) { wmi_buf_t wmi_buf; @@ -1235,7 +1235,7 @@ void wmi_buf_free(wmi_buf_t net_buf) qdf_nbuf_free(net_buf); } #else -wmi_buf_t wmi_buf_alloc(wmi_unified_t wmi_handle, uint16_t len) +wmi_buf_t wmi_buf_alloc(wmi_unified_t wmi_handle, uint32_t len) { wmi_buf_t wmi_buf; -- cgit v1.2.3 From 17e5372a33cb5cb7fd0984db30c45e00924d43a6 Mon Sep 17 00:00:00 2001 From: Yeshwanth Sriram Guntuka Date: Mon, 22 Feb 2021 16:06:20 +0530 Subject: qcacmn: Add CDP intf to flush fragments for a particular peer Add CDP interface support for flushing fragments for a particular peer. Change-Id: Ic59843408037b9c858599be13727422c2e3031cd CRs-Fixed: 2875946 --- dp/inc/cdp_txrx_peer_ops.h | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/dp/inc/cdp_txrx_peer_ops.h b/dp/inc/cdp_txrx_peer_ops.h index ec5bbf0a7488..311e5cee0f4a 100644 --- a/dp/inc/cdp_txrx_peer_ops.h +++ b/dp/inc/cdp_txrx_peer_ops.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2016-2018 The Linux Foundation. All rights reserved. + * Copyright (c) 2016-2018, 2021 The Linux Foundation. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -170,4 +170,16 @@ void ol_txrx_remove_peers_for_vdev_no_lock(ol_txrx_vdev_handle vdev, ol_txrx_vdev_peer_remove_cb callback, void *callback_context); + +/** + * ol_txrx_peer_flush_frags() - Flush fragments for a particular peer + * @pdev - datapath pdev handle + * @vdev_id - virtual device id + * @peer_mac - peer mac address + * + * Return: None + */ +void +ol_txrx_peer_flush_frags(ol_txrx_pdev_handle pdev, uint8_t vdev_id, + uint8_t *peer_mac); #endif /* _CDP_TXRX_PEER_H_ */ -- cgit v1.2.3