From b7c0c99d382843fe4d13602fc07e5fe211c7f3aa Mon Sep 17 00:00:00 2001 From: engstk Date: Wed, 9 Feb 2022 17:29:02 +0000 Subject: [PATCH] drivers: staging: qcacld: Merge branch android-msm-sunfish-4.14-android12-qpr1 (android-12.0.0_r0.39) sync: e30fcb9 qcacld-3.0: Merge branch 'android-msm-pixel-4.14-sc-security' into android-msm-pixel-4.14-sc-qpr1 sync: 2b33b7b fw-api: Merge android-msm-floral-4.14-rvc-qpr1 into android-msm-pixel-4.14 sync: 2cfb552 qcacmn: Merge branch 'android-msm-pixel-4.14-sc-security' into android-msm-pixel-4.14-sc-qpr1 Signed-off-by: engstk --- .../target_if/wifi_pos/src/target_if_wifi_pos.c | 13 ++++++++++++- .../umac/wifi_pos/src/wifi_pos_utils_i.h | 4 +++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/staging/qca-wifi-host-cmn/target_if/wifi_pos/src/target_if_wifi_pos.c b/drivers/staging/qca-wifi-host-cmn/target_if/wifi_pos/src/target_if_wifi_pos.c index f9592196e578..c66050393dfc 100644 --- a/drivers/staging/qca-wifi-host-cmn/target_if/wifi_pos/src/target_if_wifi_pos.c +++ b/drivers/staging/qca-wifi-host-cmn/target_if/wifi_pos/src/target_if_wifi_pos.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2013-2018 The Linux Foundation. All rights reserved. + * Copyright (c) 2013-2018, 2021 The Linux Foundation. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -90,6 +90,7 @@ static QDF_STATUS target_if_wifi_pos_get_indirect_data( void *paddr = NULL; uint32_t addr_hi; uint8_t ring_idx = 0, num_rings; + uint32_t allocated_len; if (!indirect) { target_if_debug("no indirect data. regular event received"); @@ -102,6 +103,16 @@ static QDF_STATUS target_if_wifi_pos_get_indirect_data( target_if_err("incorrect pdev_id: %d", indirect->pdev_id); return QDF_STATUS_E_INVAL; } + + allocated_len = priv_obj->dma_cap[ring_idx].min_buf_size + + (priv_obj->dma_cap[ring_idx].min_buf_align - 1); + if (indirect->len > allocated_len || + indirect->len > OEM_DATA_DMA_BUFF_SIZE) { + target_if_err("Invalid indirect len: %d, allocated_len:%d", + indirect->len, allocated_len); + return QDF_STATUS_E_INVAL; + } + addr_hi = (uint64_t)WMI_OEM_DMA_DATA_ADDR_HI_GET( indirect->addr_hi); paddr = (void *)((uint64_t)addr_hi << 32 | indirect->addr_lo); diff --git a/drivers/staging/qca-wifi-host-cmn/umac/wifi_pos/src/wifi_pos_utils_i.h b/drivers/staging/qca-wifi-host-cmn/umac/wifi_pos/src/wifi_pos_utils_i.h index 7172cbe9c5c2..cfef14eaa188 100644 --- a/drivers/staging/qca-wifi-host-cmn/umac/wifi_pos/src/wifi_pos_utils_i.h +++ b/drivers/staging/qca-wifi-host-cmn/umac/wifi_pos/src/wifi_pos_utils_i.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved. + * Copyright (c) 2012-2018, 2021 The Linux Foundation. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -60,6 +60,8 @@ struct wifi_pos_req_msg; #ifndef OEM_DATA_RSP_SIZE #define OEM_DATA_RSP_SIZE 1724 +/* Header + VHT80 CIR * 2 chains */ +#define OEM_DATA_DMA_BUFF_SIZE (64 + 512 * 4 * 2) #endif /**