wlan: Fix out of bound access in WDA_lowLevelIndCallback
Out of bound access is reported by kernel address
sanitizer (KASan) tool.
=====================================================================
BUG: KASAN: slab-out-of-bounds in
WDA_lowLevelIndCallback+0x25a0/0x2e64[wlan] at addr ffffffc0374bc608
Write of size 1 by task VosMCThread/19503
======================================================================
BUG kmalloc-128 (Tainted: P B W O ): kasan: bad access detected
----------------------------------------------------------------------
[<ffffffc00008c80c>] dump_backtrace+0x0/0x284
[<ffffffc00008caa0>] show_stack+0x10/0x1c
[<ffffffc001e992fc>] dump_stack+0x74/0xfc
[<ffffffc0002f3094>] print_trailer+0x150/0x164
[<ffffffc0002f345c>] object_err+0x38/0x4c
[<ffffffc0002f8994>] kasan_report+0x34c/0x504
[<ffffffc0002f8c00>] __asan_report_store1_noabort+0x14/0x20
[<ffffffbffc3d1a40>] WDA_lowLevelIndCallback+0x259c/0x2e64 [wlan]
[<ffffffbffc3f6d6c>] WDI_delBaInd+0x1b8/0x204 [wlan]
[<ffffffbffc40ba20>] WDI_MainRsp+0x25c/0x31c [wlan]
[<ffffffbffc4044e8>] WDI_PostMainEvent+0x14c/0x208 [wlan]
[<ffffffbffc40ffd0>] WDI_RXMsgCTSCB+0x3e8/0x434 [wlan]
[<ffffffbffc4502a4>] WCTS_PALDataCallback+0x158/0x4a8 [wlan]
[<ffffffbffc3a260c>] VosMCThread+0x3d4/0x950 [wlan]
[<ffffffc0000f1f24>] kthread+0x22c/0x240
======================================================================
Address memory corruption issue due to invalid size passed
to vos mem alloc function.
CRs-Fixed: 972670
Change-Id: I3b8747cf4b3c40ea5942f4b9d780e1e2d1ef41f2
diff --git a/CORE/WDA/src/wlan_qct_wda.c b/CORE/WDA/src/wlan_qct_wda.c
index 06973af..b5dd442 100644
--- a/CORE/WDA/src/wlan_qct_wda.c
+++ b/CORE/WDA/src/wlan_qct_wda.c
@@ -16204,7 +16204,7 @@
case WDI_DEL_BA_IND:
{
tpBADeleteParams pDelBAInd =
- (tpBADeleteParams)vos_mem_malloc(sizeof(tpBADeleteParams));
+ (tpBADeleteParams)vos_mem_malloc(sizeof(*pDelBAInd));
VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
"Received WDI_DEL_BA_IND from WDI ");