commit 88252cc3c7c9168bddc6d3d2bbba04c87d899340
author Bharath <bharath@fairphone.com> Tue Aug 16 10:04:57 2022 +0530
committer Bharath <bharath@fairphone.com> Thu Aug 18 19:14:34 2022 +0530
tree 0080941ff109f1ea62c889e17cc5c07bdb72410d
parent 1b85c5076c5a938b5a40c91d5bac3acde7ca9e02
parent db4e0c2e86bff194ea2d9f1bafc1dc647c963f0d

Merge tag 'LA.UM.9.6.2.c26-02500-89xx.0' into int/11/fp3

"LA.UM.9.6.2.c26-02500-89xx.0"

* tag 'LA.UM.9.6.2.c26-02500-89xx.0':
  wlan: Fix array OOB for duplicate rate
  qcacld-2.0: Fix array OOB for duplicate rate
  wlan: Fix possible OOB in UnpackTlvCore
  wlan: Fix possible OOB in unpack_tlv_core
  wlan: Avoid OOB read in dot11f_unpack_assoc_response

Change-Id: I89cdd50061ccc210b60e1666a25c7a4916137234

CORE/HDD/src/wlan_hdd_main.c

diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 9b18837..ca1e7df 100644
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -8634,7 +8634,6 @@
       /* after uninit our adapter structure will no longer be valid */
       pAdapter->dev = NULL;
       pAdapter->magic = 0;
-      pAdapter->pHddCtx = NULL;
    } while (0);
 
    EXIT();

CORE/MAC/src/pe/lim/limSendManagementFrames.c

diff --git a/CORE/MAC/src/pe/lim/limSendManagementFrames.c b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
index c776cfb..ac90ef6 100644
--- a/CORE/MAC/src/pe/lim/limSendManagementFrames.c
+++ b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
@@ -5964,15 +5964,7 @@
       frmAddBARsp.AddBAParameterSet.policy = pMlmAddBARsp->baPolicy;
       frmAddBARsp.AddBAParameterSet.bufferSize = pMlmAddBARsp->baBufferSize;
 
-      if(psessionEntry->isAmsduSupportInAMPDU)
-      {
-         frmAddBARsp.AddBAParameterSet.amsduSupported =
-                                          psessionEntry->amsduSupportedInBA;
-      }
-      else
-      {
-         frmAddBARsp.AddBAParameterSet.amsduSupported = 0;
-      }
+      frmAddBARsp.AddBAParameterSet.amsduSupported = 1;
 
       // BA timeout
       // 0 - indicates no BA timeout