samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

icnss2: Use event_data before posting event

Browse Source 
In icnss_pdr_notifier_cb() API, event_data gets free while
processing PD_SERVICE_DOWN event. In the same function
event_data->crashed is checking after posting PD_SERVICE_DOWN
event which may cause using event_data even after free.

This commit updates checking for event_data->crashed before
posting PD_SERVICE_DOWN event.

Change-Id: Ie82a0b7b4ceb40063318ab2d926b9c14412fb2c9
CRs-Fixed: 3415299
This commit is contained in:
Naman Padhiar
2023-02-24 20:44:32 +05:30
committed by Madan Koyyalamudi
parent b4a9230200
commit 01cb81be76
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
icnss2/main.c
View File

@@ -2468,13 +2468,14 @@ static void icnss_pdr_notifier_cb(int state, char *service_path, void *priv_cb)
}
}
clear_bit(ICNSS_HOST_TRIGGERED_PDR, &priv->state);
icnss_driver_event_post(priv, ICNSS_DRIVER_EVENT_PD_SERVICE_DOWN,
ICNSS_EVENT_SYNC, event_data);
if (event_data->crashed)
mod_timer(&priv->recovery_timer,
jiffies +
msecs_to_jiffies(ICNSS_RECOVERY_TIMEOUT));
icnss_driver_event_post(priv, ICNSS_DRIVER_EVENT_PD_SERVICE_DOWN,
ICNSS_EVENT_SYNC, event_data);
break;
case SERVREG_SERVICE_STATE_UP:
clear_bit(ICNSS_FW_DOWN, &priv->state);