commit c59f7dc66ee2ada08f90786d24a821c851ee821e
author Surya Prakash Raajen <sraajen@codeaurora.org> Fri Jul 12 11:53:03 2019 +0530
committer nshrivas <nshrivas@codeaurora.org> Wed Jul 31 22:18:42 2019 -0700
tree 48af6084d2b346f189b7ec14e1dd5c2d27e993fc
parent 93f7e1be90e6a8c68b368f9e50d36e183e8db1a5

qcacmn: Fix wrap-around condition check in DIAG_RX_EVENT_RECORD

Diag_log_max_entry should be used to determine wrap around condition
in DIAG_RX_EVENT_RECORD. Using incorrect max value results in invalid
access and memory corruption. Fix DIAG_RX_EVENT_RECORD to use diag_log
max entry instead of mgmt_max entry.

Change-Id: Icae3ce843b1fd76e15139fae1a867448ad032cf8
CRs-Fixed: 2488783

wmi/src/wmi_unified.c

diff --git a/wmi/src/wmi_unified.c b/wmi/src/wmi_unified.c
index a19afac..ccc685c 100644
--- a/wmi/src/wmi_unified.c
+++ b/wmi/src/wmi_unified.c
@@ -568,7 +568,7 @@
 } while (0);
 
 #define WMI_DIAG_RX_EVENT_RECORD(h, a, b) do {                             \
-	if (wmi_mgmt_log_max_entry <=                                   \
+	if (wmi_diag_log_max_entry <=                                   \
 		*(h->log_info.wmi_diag_event_log_buf_info.p_buf_tail_idx))\
 		*(h->log_info.wmi_diag_event_log_buf_info.p_buf_tail_idx) = 0;\
 	((struct wmi_event_debug *)h->log_info.wmi_diag_event_log_buf_info.buf)\