qcacld-3.0: Replace hdd_for_each_sta_ref with hdd_for_each_sta_ref_safe

Currently in some APIs hdd_for_each_sta_ref macro is used to iterate
over each station stored in the sta info container. It might become
infinite loop if same station entry used parallelly by two threads,
when one deletes the station, causing next pointer to point to
it-self hence an infinite loop will form for the other thread.

To address this issue use the hdd_for_each_sta_ref_safe macro and
for delete hdd_for_each_sta_ref macro to avoid such scenarios.

Change-Id: Ia4b2a3e1ef61a00eebddbb3a4d892a912ad3313d
CRs-Fixed: 3295300

core/hdd/src/wlan_hdd_hostapd_wext.c

@@ -149,7 +149,7 @@ static int __iw_softap_set_two_ints_getnone(struct net_device *dev,
 	struct hdd_context *hdd_ctx;
 	void *soc = cds_get_context(QDF_MODULE_ID_SOC);
 	struct cdp_txrx_stats_req req = {0};
-	struct hdd_station_info *sta_info;
+	struct hdd_station_info *sta_info, *tmp = NULL;
 
 	hdd_enter_dev(dev);
 
@@ -180,8 +180,8 @@ static int __iw_softap_set_two_ints_getnone(struct net_device *dev,
 			ret = cdp_txrx_stats_request(soc, adapter->vdev_id,
 						     &req);
 
-			hdd_for_each_sta_ref(
-					adapter->sta_info_list, sta_info,
+			hdd_for_each_sta_ref_safe(
+					adapter->sta_info_list, sta_info, tmp,
 					STA_INFO_SAP_SET_TWO_INTS_GETNONE) {
 				hdd_debug("bss_id: " QDF_MAC_ADDR_FMT,
 					  QDF_MAC_ADDR_REF(
@@ -1699,7 +1699,7 @@ static __iw_softap_getassoc_stamacaddr(struct net_device *dev,
 				       union iwreq_data *wrqu, char *extra)
 {
 	struct hdd_adapter *adapter = (netdev_priv(dev));
-	struct hdd_station_info *sta_info;
+	struct hdd_station_info *sta_info, *tmp = NULL;
 	struct hdd_context *hdd_ctx;
 	char *buf;
 	int left;
@@ -1748,8 +1748,8 @@ static __iw_softap_getassoc_stamacaddr(struct net_device *dev,
 	maclist_index = sizeof(maclist_index);
 	left = wrqu->data.length - maclist_index;
 
-	hdd_for_each_sta_ref(adapter->sta_info_list, sta_info,
-			     STA_INFO_SAP_GETASSOC_STAMACADDR) {
+	hdd_for_each_sta_ref_safe(adapter->sta_info_list, sta_info, tmp,
+				  STA_INFO_SAP_GETASSOC_STAMACADDR) {
 		if (!qdf_is_macaddr_broadcast(&sta_info->sta_mac)) {
 			memcpy(&buf[maclist_index], &sta_info->sta_mac,
 			       QDF_MAC_ADDR_SIZE);
@@ -2236,18 +2236,22 @@ static int hdd_softap_get_sta_info(struct hdd_adapter *adapter,
 				   int size)
 {
 	int written;
-	struct hdd_station_info *sta;
+	struct hdd_station_info *sta, *tmp = NULL;
 
 	hdd_enter();
 
 	written = scnprintf(buf, size, "\nstaId staAddress\n");
 
-	hdd_for_each_sta_ref(adapter->sta_info_list, sta,
-			     STA_INFO_SOFTAP_GET_STA_INFO) {
+	hdd_for_each_sta_ref_safe(adapter->sta_info_list, sta, tmp,
+				  STA_INFO_SOFTAP_GET_STA_INFO) {
 		if (written >= size - 1) {
 			hdd_put_sta_info_ref(&adapter->sta_info_list,
 					     &sta, true,
 					     STA_INFO_SOFTAP_GET_STA_INFO);
+			if (tmp)
+				hdd_put_sta_info_ref(&adapter->sta_info_list,
+						&tmp, true,
+						STA_INFO_SOFTAP_GET_STA_INFO);
 			break;
 		}
 
@@ -2505,10 +2509,10 @@ int __iw_get_softap_linkspeed(struct net_device *dev,
 	 * link speed for first connected client will be returned.
 	 */
 	if (wrqu->data.length < 17 || !QDF_IS_STATUS_SUCCESS(status)) {
-		struct hdd_station_info *sta_info;
+		struct hdd_station_info *sta_info, *tmp = NULL;
 
-		hdd_for_each_sta_ref(adapter->sta_info_list, sta_info,
-				     STA_INFO_GET_SOFTAP_LINKSPEED) {
+		hdd_for_each_sta_ref_safe(adapter->sta_info_list, sta_info, tmp,
+					  STA_INFO_GET_SOFTAP_LINKSPEED) {
 			if (!qdf_is_macaddr_broadcast(&sta_info->sta_mac)) {
 				qdf_copy_macaddr(&mac_address,
 						 &sta_info->sta_mac);
@@ -2517,6 +2521,11 @@ int __iw_get_softap_linkspeed(struct net_device *dev,
 						&adapter->sta_info_list,
 						&sta_info, true,
 						STA_INFO_GET_SOFTAP_LINKSPEED);
+				if (tmp)
+					hdd_put_sta_info_ref(
+						&adapter->sta_info_list,
+						&tmp, true,
+						STA_INFO_GET_SOFTAP_LINKSPEED);
 				break;
 			}
 			hdd_put_sta_info_ref(&adapter->sta_info_list,

core/hdd/src/wlan_hdd_son.c

@@ -1086,7 +1086,7 @@ static uint32_t hdd_son_per_sta_len(struct hdd_station_info *sta_info)
 static uint32_t hdd_son_get_sta_space(struct wlan_objmgr_vdev *vdev)
 {
 	struct hdd_adapter *adapter;
-	struct hdd_station_info *sta_info = NULL;
+	struct hdd_station_info *sta_info, *tmp = NULL;
 	uint32_t space = 0;
 
 	if (!vdev) {
@@ -1099,8 +1099,8 @@ static uint32_t hdd_son_get_sta_space(struct wlan_objmgr_vdev *vdev)
 		return space;
 	}
 
-	hdd_for_each_sta_ref(adapter->sta_info_list, sta_info,
-			     STA_INFO_SOFTAP_GET_STA_INFO) {
+	hdd_for_each_sta_ref_safe(adapter->sta_info_list, sta_info, tmp,
+				  STA_INFO_SOFTAP_GET_STA_INFO) {
 		if (!qdf_is_macaddr_broadcast(&sta_info->sta_mac))
 			space += hdd_son_per_sta_len(sta_info);
 
@@ -1126,7 +1126,7 @@ static void hdd_son_get_sta_list(struct wlan_objmgr_vdev *vdev,
 				 uint32_t *space)
 {
 	struct hdd_adapter *adapter;
-	struct hdd_station_info *sta_info = NULL;
+	struct hdd_station_info *sta_info, *tmp = NULL;
 	uint32_t len;
 	qdf_time_t current_ts;
 
@@ -1140,8 +1140,8 @@ static void hdd_son_get_sta_list(struct wlan_objmgr_vdev *vdev,
 		return;
 	}
 
-	hdd_for_each_sta_ref(adapter->sta_info_list, sta_info,
-			     STA_INFO_SOFTAP_GET_STA_INFO) {
+	hdd_for_each_sta_ref_safe(adapter->sta_info_list, sta_info, tmp,
+				  STA_INFO_SOFTAP_GET_STA_INFO) {
 		if (!qdf_is_macaddr_broadcast(&sta_info->sta_mac)) {
 			len = hdd_son_per_sta_len(sta_info);
 
@@ -1151,6 +1151,13 @@ static void hdd_son_get_sta_list(struct wlan_objmgr_vdev *vdev,
 					&adapter->sta_info_list,
 					&sta_info, true,
 					STA_INFO_SOFTAP_GET_STA_INFO);
+
+				if (tmp)
+					hdd_put_sta_info_ref(
+						&adapter->sta_info_list,
+						&tmp, true,
+						STA_INFO_SOFTAP_GET_STA_INFO);
+
 				hdd_err("space %u, length %u", *space, len);
 
 				return;

core/hdd/src/wlan_hdd_sta_info.h

@@ -392,70 +392,6 @@ hdd_get_next_sta_info_no_lock(struct hdd_sta_info_obj *sta_info_container,
 /* Abstract wrapper to check sta_info validity */
 #define __hdd_is_station_valid(sta_info) sta_info
 
-/**
- * __hdd_take_ref_and_fetch_front_sta_info - Helper macro to lock, fetch front
- * sta_info, take ref and unlock.
- * @sta_info_container: The station info container obj that stores and maintains
- *                      the sta_info obj.
- * @sta_info: The station info structure that acts as the iterator object.
- */
-#define __hdd_take_ref_and_fetch_front_sta_info(sta_info_container, sta_info, \
-						sta_info_dbgid) \
-	qdf_spin_lock_bh(&sta_info_container.sta_obj_lock), \
-	hdd_get_front_sta_info_no_lock(&sta_info_container, &sta_info), \
-	(sta_info) ? hdd_take_sta_info_ref(&sta_info_container, \
-					   sta_info, false, sta_info_dbgid) : \
-					(false), \
-	qdf_spin_unlock_bh(&sta_info_container.sta_obj_lock)
-
-/**
- * __hdd_take_ref_and_fetch_next_sta_info - Helper macro to lock, fetch next
- * sta_info, take ref and unlock.
- * @sta_info_container: The station info container obj that stores and maintains
- *                      the sta_info obj.
- * @sta_info: The station info structure that acts as the iterator object.
- */
-#define __hdd_take_ref_and_fetch_next_sta_info(sta_info_container, sta_info, \
-					       sta_info_dbgid) \
-	qdf_spin_lock_bh(&sta_info_container.sta_obj_lock), \
-	hdd_get_next_sta_info_no_lock(&sta_info_container, sta_info, \
-				      &sta_info), \
-	(sta_info) ? hdd_take_sta_info_ref(&sta_info_container, \
-					   sta_info, false, sta_info_dbgid) : \
-					(false), \
-	qdf_spin_unlock_bh(&sta_info_container.sta_obj_lock)
-
-/**
- * hdd_for_each_sta_ref - Iterate over each station stored in the sta info
- *                        container with ref taken
- * @sta_info_container: The station info container obj that stores and maintains
- *                      the sta_info obj.
- * @sta_info: The station info structure that acts as the iterator object.
- * @sta_info_dbgid: Debug ID of the caller API
- *
- * The sta_info will contain the structure that is fetched for that particular
- * iteration.
- *
- *			     ***** NOTE *****
- * Before the end of each iteration, dev_put(adapter->dev) must be
- * called. Not calling this will keep hold of a reference, thus preventing
- * unregister of the netdevice.
- *
- * Usage example:
- *	    hdd_for_each_sta_ref(sta_info_container, sta_info, sta_info_dbgid) {
- *		    <work involving station>
- *		    <some more work>
- *		    hdd_put_sta_info_ref(sta_info_container, sta_info, true,
- *					 sta_info_dbgid)
- *	    }
- */
-#define hdd_for_each_sta_ref(sta_info_container, sta_info, sta_info_dbgid) \
-	for (__hdd_take_ref_and_fetch_front_sta_info(sta_info_container, \
-						     sta_info, sta_info_dbgid);\
-	     __hdd_is_station_valid(sta_info); \
-	     __hdd_take_ref_and_fetch_next_sta_info(sta_info_container, \
-						    sta_info, sta_info_dbgid))
-
 /**
  * __hdd_take_ref_and_fetch_front_sta_info_safe - Helper macro to lock, fetch
  * front sta_info, take ref and unlock in a delete safe manner.

core/hdd/src/wlan_hdd_sysfs_sta_info.c

@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -28,7 +29,7 @@ static ssize_t __show_sta_info(struct net_device *net_dev, char *buf)
 {
 	struct hdd_adapter *adapter = netdev_priv(net_dev);
 	struct hdd_context *hdd_ctx;
-	struct hdd_station_info *sta;
+	struct hdd_station_info *sta, *tmp = NULL;
 	int ret_val;
 
 	hdd_enter_dev(net_dev);
@@ -49,7 +50,8 @@ static ssize_t __show_sta_info(struct net_device *net_dev, char *buf)
 			    "%s    get_sta_info:\nstaAddress\n",
 			    net_dev->name);
 
-	hdd_for_each_sta_ref(adapter->sta_info_list, sta, STA_INFO_SHOW) {
+	hdd_for_each_sta_ref_safe(adapter->sta_info_list, sta, tmp,
+				  STA_INFO_SHOW) {
 		if (QDF_IS_ADDR_BROADCAST(sta->sta_mac.bytes)) {
 			hdd_put_sta_info_ref(&adapter->sta_info_list, &sta,
 					     true, STA_INFO_SHOW);