commit 5eec74aac43381c18cf6d4284f534093067f0e14
author Madan Mohan Koyyalamudi <c_mkoyya@qca.qualcomm.com> Fri Sep 28 14:59:25 2012 -0700
committer Jeff Johnson <jjohnson@qca.qualcomm.com> Fri Nov 30 13:23:02 2012 -0800
tree c26d9b4c7d30a86e3703e5f2ee72a6df4baf12c5
parent 3352adb9810a8dc503a920029c75c1155fb9cee3

wlan: Fix for memory corruption in WDA WDA_TriggerBaReqCallback.

Change-Id: If061821513b6ea639a416ab9cb1cce0422a4264a
CR-Fixed: 400804

CORE/WDA/src/wlan_qct_wda.c

diff --git a/CORE/WDA/src/wlan_qct_wda.c b/CORE/WDA/src/wlan_qct_wda.c
index f9105e7..bacb380 100644
--- a/CORE/WDA/src/wlan_qct_wda.c
+++ b/CORE/WDA/src/wlan_qct_wda.c
@@ -9990,8 +9990,6 @@
       for(i = 0 ; i < baCandidateCount ; i++)
       {
          tANI_U8 tid = 0 ;
-         wdiBaCandidate = (wdiBaCandidate + i) ;
-         baCandidate = (baCandidate + i) ;
          vos_mem_copy(baCandidate->staAddr, wdiBaCandidate->macSTA, 
                                                    sizeof(tSirMacAddr)) ;
          for(tid = 0 ; tid < STACFG_MAX_TC; tid++)
@@ -10001,6 +9999,8 @@
              baCandidate->baInfo[tid].startingSeqNum = 
                               wdiBaCandidate->wdiBAInfo[tid].startingSeqNum ;
          }
+         wdiBaCandidate++ ;
+         baCandidate++ ;
       }
       WDA_SendMsg(pWDA, SIR_LIM_ADD_BA_IND, (void *)baActivityInd , 0) ;
    }
@@ -11527,4 +11527,4 @@
 {
    WDI_TransportChannelDebug(displaySnapshot, toggleStallDetect);
    return;
-}
\ No newline at end of file
+}