samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Forkuj 0
Kod Zgłoszenia Oczekujące zmiany Actions Packages Projekty Wydania Wiki Aktywność

qcacmn: Get next node and then delete current queue

Przeglądaj źródła 
It will delete current node and then get next node by current node,
which cause NULL pointer access.

Change-Id: Ieb1f1fe924d4c86368e340b2482f2ffdb09f301f
CRs-Fixed: 2297087
This commit is contained in:
Wu Gao
2018-08-16 13:25:29 +08:00
zatwierdzone przez Nitesh Shrivastav
rodzic 31320b31bc
commit 23ae49236f
1 zmienionych plików z 4 dodań i 4 usunięć
Ściągnij plik aktualizacji Ściągnij plik porównania Expand all files Collapse all files

8
umac/p2p/core/src/wlan_p2p_off_chan_tx.c
Wyświetl plik

@@ -1721,6 +1721,8 @@ QDF_STATUS p2p_process_cleanup_tx_queue(struct p2p_cleanup_param *param)
while (QDF_IS_STATUS_SUCCESS(status)) {
curr_tx_ctx = qdf_container_of(p_node,
struct tx_action_context, node);
status = qdf_list_peek_next(&p2p_soc_obj->tx_q_roc,
p_node, &p_node);
if ((vdev_id == P2P_INVALID_VDEV_ID) ||
(vdev_id == curr_tx_ctx->vdev_id)) {
ret = qdf_list_remove_node(&p2p_soc_obj->tx_q_roc,
@@ -1733,8 +1735,6 @@ QDF_STATUS p2p_process_cleanup_tx_queue(struct p2p_cleanup_param *param)
p2p_err("remove %pK from roc_q fail",
curr_tx_ctx);
}
status = qdf_list_peek_next(&p2p_soc_obj->tx_q_roc,
p_node, &p_node);
}
p2p_debug("clean up tx queue wait for ack, size:%d",
@@ -1744,6 +1744,8 @@ QDF_STATUS p2p_process_cleanup_tx_queue(struct p2p_cleanup_param *param)
while (QDF_IS_STATUS_SUCCESS(status)) {
curr_tx_ctx = qdf_container_of(p_node,
struct tx_action_context, node);
status = qdf_list_peek_next(&p2p_soc_obj->tx_q_ack,
p_node, &p_node);
if ((vdev_id == P2P_INVALID_VDEV_ID) ||
(vdev_id == curr_tx_ctx->vdev_id)) {
ret = qdf_list_remove_node(&p2p_soc_obj->tx_q_ack,
@@ -1757,8 +1759,6 @@ QDF_STATUS p2p_process_cleanup_tx_queue(struct p2p_cleanup_param *param)
p2p_err("remove %pK from roc_q fail",
curr_tx_ctx);
}
status = qdf_list_peek_next(&p2p_soc_obj->tx_q_ack,
p_node, &p_node);
}
qdf_event_set(&p2p_soc_obj->cleanup_tx_done);