commit f75c37b6b0d46f19ea5b8b3882c22ea71dae37b1
author Padma, Santhosh Kumar <skpadma@qti.qualcomm.com> Mon Jan 25 10:36:08 2016 +0530
committer Anjaneedevi Kapparapu <akappa@codeaurora.org> Thu Jan 28 15:43:12 2016 +0530
tree d8ac1635c16b5d6fe8acc93cfa5600d355d3b776
parent 589c572bbc59d6c61477c113500038592f4b4259

prima: Add oem data rsp length

Currently NEW_OEM_DATA_RSP_SIZE no of bytes are defined statically
between host and fw for oem rsp exchange. But fw is not using all
of those bytes which results in lowi reading data from unauthorized
memory locations. Fix this by sending proper length to LOWI.

Change-Id: Idb1176111a9585b8f727fb01dda1a6079151c867
CRs-Fixed: 965180

CORE/WDI/CP/inc/wlan_qct_wdi.h

diff --git a/CORE/WDI/CP/inc/wlan_qct_wdi.h b/CORE/WDI/CP/inc/wlan_qct_wdi.h
index a49fa09..5397e51 100644
--- a/CORE/WDI/CP/inc/wlan_qct_wdi.h
+++ b/CORE/WDI/CP/inc/wlan_qct_wdi.h
@@ -908,6 +908,19 @@
     wpt_uint32 tx_complete_status;
     wpt_uint32 tx_bd_token;
 }  WDI_TxBDStatus;
+
+#ifdef FEATURE_OEM_DATA_SUPPORT
+/*----------------------------------------------------------------------------
+  OEM DATA RESPONSE - DATA STRUCTURES
+----------------------------------------------------------------------------*/
+typedef struct
+{
+    void *pOemRspNewIndData;
+    /* Max OemRspNewLen possible is NEW_OEM_DATA_RSP_SIZE*/
+    wpt_uint32 OemRspNewLen;
+} WDI_OemDataRspNew;
+#endif
+
 /*---------------------------------------------------------------------------
   WDI_LowLevelIndType
     Inidcation type and information about the indication being carried
@@ -994,7 +1007,7 @@
     WDI_RssiBreachedIndType     wdiRssiBreachedInd;
 #ifdef FEATURE_OEM_DATA_SUPPORT
 /*OEM Data Rsp New Results from FW*/
-    void *pOemRspNewIndData;
+    WDI_OemDataRspNew           wdiOemDataRspNew;
 #endif
   }  wdiIndicationData;
 }WDI_LowLevelIndType;
@@ -4730,14 +4743,6 @@
     wpt_uint8  oemDataReqNew[NEW_OEM_DATA_REQ_SIZE];
 } WDI_OemDataReqNew, WDI_OemDataReqNewConfig;
 
-/*----------------------------------------------------------------------------
-  OEM DATA RESPONSE - DATA STRUCTURES
-----------------------------------------------------------------------------*/
-typedef struct
-{
-    wpt_uint8  oemDataRspNew[NEW_OEM_DATA_RSP_SIZE];
-} WDI_OemDataRspNew;
-
 /*************************************************************************************************************/
 
 #endif /* FEATURE_OEM_DATA_SUPPORT */

CORE/WDI/CP/src/wlan_qct_wdi.c

diff --git a/CORE/WDI/CP/src/wlan_qct_wdi.c b/CORE/WDI/CP/src/wlan_qct_wdi.c
index 9db551b..406b4fc 100644
--- a/CORE/WDI/CP/src/wlan_qct_wdi.c
+++ b/CORE/WDI/CP/src/wlan_qct_wdi.c
@@ -36657,9 +36657,10 @@
     /* Fill in the indication parameters */
     wdiInd.wdiIndicationType = WDI_START_OEM_DATA_RSP_IND_NEW;
 
-    /* extract response and send it to UMAC */
-    wdiInd.wdiIndicationData.pOemRspNewIndData = (void *)pEventData->pEventData;
-
+    wdiInd.wdiIndicationData.wdiOemDataRspNew.pOemRspNewIndData =
+                                                (void *)pEventData->pEventData;
+    wdiInd.wdiIndicationData.wdiOemDataRspNew.OemRspNewLen =
+                                                    pEventData->uEventDataSize;
     /* Notify UMAC */
     if (pWDICtx->wdiLowLevelIndCB)
     {