commit f75c37b6b0d46f19ea5b8b3882c22ea71dae37b1
author Padma, Santhosh Kumar <skpadma@qti.qualcomm.com> Mon Jan 25 10:36:08 2016 +0530
committer Anjaneedevi Kapparapu <akappa@codeaurora.org> Thu Jan 28 15:43:12 2016 +0530
tree d8ac1635c16b5d6fe8acc93cfa5600d355d3b776
parent 589c572bbc59d6c61477c113500038592f4b4259

prima: Add oem data rsp length

Currently NEW_OEM_DATA_RSP_SIZE no of bytes are defined statically
between host and fw for oem rsp exchange. But fw is not using all
of those bytes which results in lowi reading data from unauthorized
memory locations. Fix this by sending proper length to LOWI.

Change-Id: Idb1176111a9585b8f727fb01dda1a6079151c867
CRs-Fixed: 965180

CORE/HDD/src/wlan_hdd_cfg80211.c

diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index 48223a1..68b6c7d 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -19211,7 +19211,7 @@
 
 #ifdef FEATURE_OEM_DATA_SUPPORT
 static void wlan_hdd_cfg80211_oem_data_rsp_ind_new(void *ctx,
-                                                      void *pMsg)
+                                   void *pMsg, tANI_U32 evLen)
 {
     hdd_context_t *pHddCtx         = (hdd_context_t *)ctx;
 
@@ -19226,7 +19226,7 @@
         return;
     }
 
-    send_oem_data_rsp_msg(sizeof(tOemDataRspNew), pMsg);
+    send_oem_data_rsp_msg(evLen, pMsg);
 
     EXIT();
     return;
@@ -19234,7 +19234,7 @@
 }
 
 void wlan_hdd_cfg80211_oemdata_callback(void *ctx, const tANI_U16 evType,
-                                      void *pMsg)
+                                      void *pMsg,  tANI_U32 evLen)
 {
     hdd_context_t *pHddCtx = (hdd_context_t *)ctx;
 
@@ -19244,11 +19244,11 @@
         return;
     }
 
-    hddLog(VOS_TRACE_LEVEL_INFO, FL("Rcvd Event (%d)"), evType);
+    hddLog(VOS_TRACE_LEVEL_INFO, FL("Rcvd Event (%d) evLen %d"), evType, evLen);
 
     switch(evType) {
     case SIR_HAL_START_OEM_DATA_RSP_IND_NEW:
-        wlan_hdd_cfg80211_oem_data_rsp_ind_new(ctx, pMsg);
+        wlan_hdd_cfg80211_oem_data_rsp_ind_new(ctx, pMsg, evLen);
         break;
     default:
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("invalid event type %d "), evType);

CORE/HDD/src/wlan_hdd_oemdata.c

diff --git a/CORE/HDD/src/wlan_hdd_oemdata.c b/CORE/HDD/src/wlan_hdd_oemdata.c
index 93da9dc..ca2c812 100644
--- a/CORE/HDD/src/wlan_hdd_oemdata.c
+++ b/CORE/HDD/src/wlan_hdd_oemdata.c
@@ -582,7 +582,7 @@
   \return - 0 for success, non zero for failure
 
   --------------------------------------------------------------------------*/
-void send_oem_data_rsp_msg(int length, tANI_U8 *oemDataRsp)
+void send_oem_data_rsp_msg(tANI_U32 length, tANI_U8 *oemDataRsp)
 {
    struct sk_buff *skb;
    struct nlmsghdr *nlh;
@@ -604,7 +604,7 @@
       return;
    }
 
-   skb = alloc_skb(NLMSG_SPACE(sizeof(tAniMsgHdr) + NEW_OEM_DATA_RSP_SIZE),
+   skb = alloc_skb(NLMSG_SPACE(sizeof(tAniMsgHdr) + length),
                    GFP_KERNEL);
    if (skb == NULL)
    {