qcacmn: Fix double free false positive with qdf_nbuf_unshare

In qdf_nbuf_unshare_debug() API remove the refernce of old nbuf
before calling skb_unshare(). As skb_unshare() will free old nbuf
and allocate a new one for a cloned skb.

Change-Id: I2a2f0277934268a346e13a0779e204f02c9bcf5b
此提交包含在:
Chaithanya Garrepalli
2021-03-05 13:04:48 +05:30
提交者 snandini
父節點 ca3deac271
當前提交 20500d66ae

查看文件

@@ -3104,6 +3104,10 @@ qdf_nbuf_unshare_debug(qdf_nbuf_t buf, const char *func_name,
if (is_initial_mem_debug_disabled)
return __qdf_nbuf_unshare(buf);
/* Not a shared buffer, nothing to do */
if (!qdf_nbuf_is_cloned(buf))
return buf;
/* Take care to delete the debug entries for frags */
num_nr_frags = qdf_nbuf_get_nr_frags(buf);
@@ -3115,17 +3119,14 @@ qdf_nbuf_unshare_debug(qdf_nbuf_t buf, const char *func_name,
idx++;
}
qdf_net_buf_debug_delete_node(buf);
unshared_buf = __qdf_nbuf_unshare(buf);
if (qdf_likely(buf != unshared_buf)) {
qdf_net_buf_debug_delete_node(buf);
if (qdf_likely(unshared_buf)) {
qdf_net_buf_debug_add_node(unshared_buf, 0,
func_name, line_num);
if (unshared_buf)
qdf_net_buf_debug_add_node(unshared_buf, 0,
func_name, line_num);
}
if (unshared_buf) {
/* Take care to add the debug entries for frags */
num_nr_frags = qdf_nbuf_get_nr_frags(unshared_buf);