Commit 96036e42 authored Jul 03, 2020 by Yu Tian Committed by snandini Jul 14, 2020

qcacmn: fix index overflow when tso seg large

In some cases, TSO segment may larger than 255.
If use uint8 as the loop index, tx logic will
overflow and sending the last segment repeatly,
then lead to buffer double free. Change index
variable to uint32

CRs-Fixed: 2722918

Change-Id: I156a5d8b8a3895e4f7bfc53cf5561f51ca8b06ca

parent 659d8bfe

dp/wifi3.0/dp_tx.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1709,7 +1709,7 @@ noinline
		qdf_nbuf_t dp_tx_send_msdu_multiple(struct dp_vdev *vdev, qdf_nbuf_t nbuf,
		struct dp_tx_msdu_info_s *msdu_info)
		{
		uint8_t i;
		uint32_t i;
		struct dp_pdev *pdev = vdev->pdev;
		struct dp_soc *soc = pdev->soc;
		struct dp_tx_desc_s *tx_desc;