The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.
Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.
Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
Memory corruption while handling user packets during VBO bind operation.
Memory corruption when allocating and accessing an entry in an SMEM partition.
Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size.
Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.
Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
Transient DOS while parsing fragments of MBSSID IE from beacon frame.
Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.
Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time.
Memory corruption while processing graphics kernel driver request to create DMA fence.
Transient DOS while parsing the received TID-to-link mapping action frame.
Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
Transient DOS while processing TID-to-link mapping IE elements.
Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
Transient DOS while parsing ESP IE from beacon/probe response frame.
Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.
Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.
Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.
Memory corruption while handling session errors from firmware.
Transient DOS while processing the CU information from RNR IE.
Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.
Memory corruption while processing multiple IOCTL calls from HLOS to DSP.
Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.