Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 32eaabf0 authored by Yu Tian's avatar Yu Tian Committed by snandini
Browse files

qcacmn: Fix static code analysis issues in DP 

hdr_ptr is in skb_buffer data, it's assigned with 6B array,
use uint8_t point convert to avoid SA overflow warnning.

tid has asseration protect, but need to break execute to avoid
of SA warnning

Fix use-after-free of ast_entry

Change-Id: I0835f93291cf3da2b4fd57d8c9a90f20a60c11ee
CRs-Fixed: 2751678
parent 24e9afb7

dp/wifi3.0/dp_peer.c

+2 −2
Original line number Diff line number Diff line
@@ -755,8 +755,8 @@ int dp_peer_add_ast(struct dp_soc *soc, 
			 * packet from station to the root via the repeater

			 * should not remove the wds entry.

			 */

			if ((ast_entry->type == CDP_TXRX_AST_TYPE_WDS) &&

			    (type == CDP_TXRX_AST_TYPE_MEC) &&

			else if ((type == CDP_TXRX_AST_TYPE_MEC) &&

			    (ast_entry->type == CDP_TXRX_AST_TYPE_WDS) &&

			    (ast_entry->peer == peer)) {

				ast_entry->is_active = FALSE;

				dp_peer_del_ast(soc, ast_entry);

dp/wifi3.0/dp_rx_defrag.c

+1 −0
Original line number Diff line number Diff line
@@ -1636,6 +1636,7 @@ dp_rx_defrag_store_fragment(struct dp_soc *soc, 
	if (tid >= DP_MAX_TIDS) {

		dp_info("TID out of bounds: %d", tid);

		qdf_assert_always(0);

		goto discard_frag;

	}



	pdev = peer->vdev->pdev;

dp/wifi3.0/dp_tx.c

+1 −1
Original line number Diff line number Diff line
@@ -1359,7 +1359,7 @@ static void dp_tx_get_tid(struct dp_vdev *vdev, qdf_nbuf_t nbuf, 
	DP_TX_TID_OVERRIDE(msdu_info, nbuf);

	if (qdf_likely(vdev->tx_encap_type != htt_cmn_pkt_type_raw)) {

		eh = (qdf_ether_header_t *)nbuf->data;

		hdr_ptr = eh->ether_dhost;

		hdr_ptr = (uint8_t *)(eh->ether_dhost);

		L3datap = hdr_ptr + sizeof(qdf_ether_header_t);

	} else {

		qdf_dot3_qosframe_t *qos_wh =