Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cd92dc47 authored by Ben Wang's avatar Ben Wang Committed by snandini
Browse files

qcacmn: Keep rx_refill_buf_ring using index pdev->lmac_id under MCL case 

Fix static analysis issue of rx_refill_buf_ring buffer overflow.
rx_refill_buf_ring length is different for WIN/MCL. For MCL length is 1,
WIN is 3. So rx_refill_buf_ring should always use index pdev->lmac_id to
replenish rx buffer for different MACs under MCL.

Change-Id: I00af069c09c01a81ae4aa54bad5beb79dc6fcff5
CRs-Fixed: 2703683
parent 4c32a084

dp/wifi3.0/dp_main.c

+8 −2
Original line number Diff line number Diff line
@@ -1765,8 +1765,14 @@ static int dp_process_lmac_rings(struct dp_intr *int_ctx, int total_budget) 
					(1 << mac_for_pdev)) {

			union dp_rx_desc_list_elem_t *desc_list = NULL;

			union dp_rx_desc_list_elem_t *tail = NULL;

			struct dp_srng *rx_refill_buf_ring =

			struct dp_srng *rx_refill_buf_ring;



			if (wlan_cfg_per_pdev_lmac_ring(soc->wlan_cfg_ctx))

				rx_refill_buf_ring =

					&soc->rx_refill_buf_ring[mac_for_pdev];

			else

				rx_refill_buf_ring =

					&soc->rx_refill_buf_ring[pdev->lmac_id];



			intr_stats->num_host2rxdma_ring_masks++;

			DP_STATS_INC(pdev, replenish.low_thresh_intrs,

dp/wifi3.0/dp_rx_err.c

+4 −1
Original line number Diff line number Diff line
@@ -2237,7 +2237,10 @@ dp_rxdma_err_process(struct dp_intr *int_ctx, struct dp_soc *soc, 
	dp_srng_access_end(int_ctx, soc, err_dst_srng);



	if (rx_bufs_used) {

		if (wlan_cfg_per_pdev_lmac_ring(soc->wlan_cfg_ctx))

			dp_rxdma_srng = &soc->rx_refill_buf_ring[mac_id];

		else

			dp_rxdma_srng = &soc->rx_refill_buf_ring[pdev->lmac_id];

		rx_desc_pool = &soc->rx_desc_buf[mac_id];



		dp_rx_buffers_replenish(soc, mac_id, dp_rxdma_srng,