{"push_id":2442639942,"size":82,"distinct_size":11,"ref":"refs/heads/wlan-cld3.driver.lnx.1.1.c9","head":"2ffa8ae51bf3170a61d2c6dccfa691e75e027df8","before":"c655eaeb456acc0632cfb03f911a73bf73d8affb","commits":[{"sha":"7fdaa3428ca7ca1177f471522d648ce5f0435821","author":{"name":"Hanumanth Reddy Pothula","email":"0ba8aec8f696dfe5ca3bcea5fd59481b023a2715@codeaurora.org"},"message":"qcacld-3.0: Pass valid default scan IEs to firmware\n\nDuring driver re-init, host might pass invalid(NULL) default scan\nIEs to FW if host won't receive same IEs from supplicant as part\nof vendor event QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION.\n\nValidate driver has default scan IEs, before sending same to\nfirmware.\n\nChange-Id: I333ceead0c375bfb9309466e420a6860199826dc\nCRs-Fixed: 2155312","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/7fdaa3428ca7ca1177f471522d648ce5f0435821"},{"sha":"54cb93aaa5502a550940eca3bb266703d54b2132","author":{"name":"Sourav Mohapatra","email":"30e9d73c042d980fda1c79361f84aa219eea019a@codeaurora.org"},"message":"qcacld-3.0: Remove check to disable memdump for FTM mode\n\nDuring init and deinit, the driver performs memdymp_init and\nmemdump_deinit. These are not done for the case when driver is in\nFTM mode. In the present scenario, unloading the driver while in\nFTM mode and then reloading causes problem.\n\nAllow memdump_init and memdump_deinit to occur while the driver is\nin FTM mode.\n\nChange-Id: I4bed1bf76ee19612da9c27fe6cebb586ef7e542b\nCRs-Fixed: 2170695","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/54cb93aaa5502a550940eca3bb266703d54b2132"},{"sha":"c9b475873fcaa75a682372d13e854d1e49306b8d","author":{"name":"Abhinav Kumar","email":"9e2d6d875eb8c8dfa2acd0ed9b3628e21bae75eb@codeaurora.org"},"message":"qcacld-3.0: Fix multiple length definition issue in WLAN FW message\n\nCurrently, firmware fills the num variables value of param_tlvs\nstructure for all wmi commands. But during buffer write the fixed param\nvalues are used to check maximum limit of buffer in wmi commands.\nDue to multiple length definition of num variable in WLAN FW message,\nnum variables of param_tlvs may not equal to max limit defined in\nfixed_param, resulting OOB issues in WLAN FW messages during buffer write.\nAdd sanity check to make sure that num variables value doesn’t exceed max\nlimit of num value defined in param_tlvs.\n\nChange-Id: I43c15557057ab5b900f19b9f54426dcdf85e2c27\nCRs-Fixed: 2153638","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/c9b475873fcaa75a682372d13e854d1e49306b8d"},{"sha":"469d0749ba2c02a4756cb37880d0a029a4c2808b","author":{"name":"Ashish Kumar Dhanotiya","email":"7d699db8eba266aab8757e9baa4e23ab2cb09870@codeaurora.org"},"message":"qcacld-3.0: At SAP,cache every station's info only once\n\nSAP is caching the info of same station every time that station\nis getting connected and disconnected. This may result in\ncaching of the same station's info multiple times.\nIt will enable the query of same STA info multiple times\nwhich will return wrong info after first successful query.\n\nTo address this issue, cache each STA's info only once.\n\nChange-Id: Ie56931c0b703ce7a0b2eb370844c37f7473c0ae3\nCRs-Fixed: 2169301","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/469d0749ba2c02a4756cb37880d0a029a4c2808b"},{"sha":"192ac2ee90e526e7611a6356ca53868a89d84387","author":{"name":"Vignesh Viswanathan","email":"ac8078762fb0b1f12af9e4ebde85ff297f515827@codeaurora.org"},"message":"qcacld-3.0: Add sanity check for WMA NDP event handlers\n\nIn wma_ndp_confirm_event_handler & wma_ndp_indication_event_handler,\nndp_cfg len & num_ndp_app_info is from fw. If they are greater than\nthe actual length of buffer sent in FW, OOB access and info leak\nwould occur.\n\nAdd sanity checks for ndp_cfg_len and num_npd_app_info with the\nactual length of the buffer from TLV header in functions\nwma_ndp_confirm_event_handler and wma_ndp_indication_event_handler\nto prevent OOB access.\n\nChange-Id: I9ecf55a3606036d3e1f0916c948c4360475965fa\nCRs-Fixed: 2175439","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/192ac2ee90e526e7611a6356ca53868a89d84387"},{"sha":"56ce815ef8b6c7c247e77caadf3fcee50f9da18c","author":{"name":"CNSS_WLAN Service","email":"af996d3d5295148ff600e8ce170568de3fd62ce0@qualcomm.com"},"message":"Merge \"qcacld-3.0: Add sanity check for WMA NDP event handlers\" into wlan-cld3.driver.lnx.1.1.c9","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/56ce815ef8b6c7c247e77caadf3fcee50f9da18c"},{"sha":"b695ce1054b6650bee1139dbc58cf545699d5471","author":{"name":"Tiger Yu","email":"b1787d2e4afabc28086933ac5031e667e841d33e@codeaurora.org"},"message":"qcacld-3.0: Fix potential buffer overflow in ol_txrx_update_tx_queue_groups\n\nCheck for the validity of group_id when received the htt message of\nHTT_T2H_MSG_TYPE_TX_CREDIT_UPDATE_IND from firmware to ensure the buffer\noverflow does not happen.\n\nChange-Id: I17ac9f37a1450f32fb080c3b22f6317b6238068c\nCRs-Fixed: 2148610","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/b695ce1054b6650bee1139dbc58cf545699d5471"},{"sha":"d2cff49d2e731bb939dfd2aa727d6e8f484ec96f","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"qcacld-3.0: Fix multiple length definition issue in WLAN FW message\"","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/d2cff49d2e731bb939dfd2aa727d6e8f484ec96f"},{"sha":"27381e9d253629180dcdaa698d3fd01bec28d351","author":{"name":"Hanumanth Reddy Pothula","email":"0ba8aec8f696dfe5ca3bcea5fd59481b023a2715@codeaurora.org"},"message":"qcacld-3.0: Validate wpa ie length before extracting ie\n\nDuring initializing ibss security settings there is a possibility\nof integer underflow while extracting wpa ie because of ie length\ncheck miss.\n\nAdd wpa ie length boundary check before extracting wpa ie.\n\nChange-Id: I37d8ee5ea1e1ba12277128a1407783f5647251b6\nCRs-Fixed: 2151241","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/27381e9d253629180dcdaa698d3fd01bec28d351"},{"sha":"d11adb4c83b37fbe97c149729e6a81d38279aad9","author":{"name":"Vignesh Viswanathan","email":"ac8078762fb0b1f12af9e4ebde85ff297f515827@codeaurora.org"},"message":"qcacld-3.0: Fix potential OOB read in wma_populate_soc_caps\n\nIn function wma_populate_soc_caps, param_buf is received from the FW and\nsoc_hw_mode_caps->num_hw_modes denotes the number of HW mode capabilities\nincluded under hw_mode_caps. However, the actual length of the\nhw_mode_caps buffer filled by the FW is num_hw_mode_caps.\nIf the value of soc_hw_mode_caps->num_hw_modes is greater than\nnum_hw_mode_caps, then an OOB read would occur while copying the FW buffer\nfor hw_mode_caps.\n\nSimilarly, soc_hal_reg_caps->num_phy denotes the number of hal_reg_caps\nincluded in the FW buffer. However the actual length of the hal_reg_caps\nis num_hal_reg_caps. If the value of soc_hal_reg_caps->num_phy is greater\nthan num_hal_reg_caps, an OOB read would occur.\n\nAdd checks to make sure soc_hw_mode_caps->num_hw_modes is not greater\nthan num_hw_mode_caps.\nAlso add check to make sure soc_hal_reg_caps->num_phy is not greater\nthan num_hal_reg_caps.\n\nChange-Id: I3accffca3fc83f7e614d8f9a5bb850733a508ff7\nCRs-Fixed: 2160423","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/d11adb4c83b37fbe97c149729e6a81d38279aad9"},{"sha":"21b045f67901dc0c1606fcbeb6163d0fe29357ad","author":{"name":"Poddar, Siddarth","email":"e8268b92bfc9a7f31d10e684beb8fd4a79f2b42c@codeaurora.org"},"message":"qcacld-3.0: Extend wma arp handler to support other stats\n\nExtend wma ARP stats handler function to handle other\nconnectivity stats data for TCP and IPv4.\n\nChange-Id: Ibf14212eee3f7eff3841426d30b0728da04eb124\nCRs-Fixed: 2161889","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/21b045f67901dc0c1606fcbeb6163d0fe29357ad"},{"sha":"370bc90c73275c9cfacc8dac0cf2b76ec0cf6f64","author":{"name":"Alok Kumar","email":"7a4b813281bf30859940750e00b24ee65c352ad2@codeaurora.org"},"message":"qcacld-3.0: Fix buffer overflow in ol_tx_inspect_handler\n\nCurrently variable \"tx_desc_id\" is from message and it\nis used without check.This may cause buffer over-write.\n\nTo address this issue add check for valid \"tx_desc_id\"\n\nChange-Id: Ifcdbf60ce1e0f81be77308185ab51b59746c21af\nCRs-Fixed: 2146878","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/370bc90c73275c9cfacc8dac0cf2b76ec0cf6f64"},{"sha":"5b9a2ad5d0e6ea4e084b121c889e642f8877fc86","author":{"name":"Alok Kumar","email":"7a4b813281bf30859940750e00b24ee65c352ad2@codeaurora.org"},"message":"qcacld-3.0: Fix buffer overflow in htt_t2h_rx_in_order_indication_handler\n\nCurrently variable \"tid\" is from message, which is used directly\nas array size which causes buffer over-write.\n\nTo address this issue add check for the array size.\n\nChange-Id: I9b9d028ddb9566938f93ff8155284876c1ef9c03\nCRs-Fixed: 2146949","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/5b9a2ad5d0e6ea4e084b121c889e642f8877fc86"},{"sha":"cee96c1e1fdcee9af9cfc18af01ff9d63af9b493","author":{"name":"Alok Kumar","email":"7a4b813281bf30859940750e00b24ee65c352ad2@codeaurora.org"},"message":"qcacld-3.0: Fix potential buffer overflow htt_t2h_msg_handler\n\nCurrently variable \"tid\" is from message, which is used\ndirectly as array size which causes buffer over-write.\n\nTo address this issue add check for the array size.\n\nChange-Id: I9fae424d19ce5e886d385071863cbfca9633dd84\nCRs-Fixed: 2148184","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/cee96c1e1fdcee9af9cfc18af01ff9d63af9b493"},{"sha":"a6d4557ce1b4a8d801785367c2be1654ff5e7764","author":{"name":"Alok Kumar","email":"7a4b813281bf30859940750e00b24ee65c352ad2@codeaurora.org"},"message":"qcacld-3.0: Fix buffer overflow in fill_ieee80211_hdr_data\n\nCurrently variable pl_msdu_info->num_msdu is from message, and\nis used directly as array size. This may cause buffer overflow.\n\nTo address this issue add qdf_assert check.\n\nChange-Id: I44e0717c0073f6de20ee91c54f587edcaacd10a4\nCRs-Fixed: 2148637","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/a6d4557ce1b4a8d801785367c2be1654ff5e7764"},{"sha":"41855770e9dee8e9c52dc8de0f61a79fa14e2dbd","author":{"name":"CNSS_WLAN Service","email":"af996d3d5295148ff600e8ce170568de3fd62ce0@qualcomm.com"},"message":"Merge \"qcacld-3.0: Extend wma arp handler to support other stats\" into wlan-cld3.driver.lnx.1.1.c9","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/41855770e9dee8e9c52dc8de0f61a79fa14e2dbd"},{"sha":"48e7b968b9de800a6029a7b2e1a729c48e26f399","author":{"name":"CNSS_WLAN Service","email":"af996d3d5295148ff600e8ce170568de3fd62ce0@qualcomm.com"},"message":"Merge \"qcacld-3.0: Fix buffer overflow in htt_t2h_rx_in_order_indication_handler\" into wlan-cld3.driver.lnx.1.1.c9","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/48e7b968b9de800a6029a7b2e1a729c48e26f399"},{"sha":"d2c2648aa0b9309a296b019741be19fc78a062e1","author":{"name":"CNSS_WLAN Service","email":"af996d3d5295148ff600e8ce170568de3fd62ce0@qualcomm.com"},"message":"Merge \"qcacld-3.0: Fix buffer overflow in fill_ieee80211_hdr_data\" into wlan-cld3.driver.lnx.1.1.c9","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/d2c2648aa0b9309a296b019741be19fc78a062e1"},{"sha":"8bf624cb9712178fb63bff07ee732113f0dc59d7","author":{"name":"CNSS_WLAN Service","email":"af996d3d5295148ff600e8ce170568de3fd62ce0@qualcomm.com"},"message":"Merge \"qcacld-3.0: Fix potential buffer overflow htt_t2h_msg_handler\" into wlan-cld3.driver.lnx.1.1.c9","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/8bf624cb9712178fb63bff07ee732113f0dc59d7"},{"sha":"226681a6a828cb881505b8a7bd2c59d274c528f6","author":{"name":"CNSS_WLAN Service","email":"af996d3d5295148ff600e8ce170568de3fd62ce0@qualcomm.com"},"message":"Merge \"qcacld-3.0: Remove check to disable memdump for FTM mode\" into wlan-cld3.driver.lnx.1.1.c9","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/platform-vendor-qcom-opensource-wlan-qcacld-3.0/commits/226681a6a828cb881505b8a7bd2c59d274c528f6"}]}
{"actor":{"display_login":"Mazda--"}}