Przeglądaj źródła

qcacld-3.0: Fix crash in TDLS functionality

qcacld-2.0 to qcacld-3.0 propagation

Currently, tdls lock has not been acquired and if tdls peer or
tdls context freed in other context then it will lead to crash.
Fix is to ensure that the tdls lock is acquired for tdls peer
list and tdls context.

Change-Id: I52c3e7b67c7f61160c54a1a6688db09f0137b7e1
CRs-Fixed: 945302
Masti, Narayanraddi 8 lat temu
rodzic
commit
27fbec7970
1 zmienionych plików z 17 dodań i 5 usunięć
  1. 17 5
      core/hdd/src/wlan_hdd_tdls.c

+ 17 - 5
core/hdd/src/wlan_hdd_tdls.c

@@ -874,22 +874,34 @@ void wlan_hdd_tdls_exit(hdd_adapter_t *pAdapter)
 
 	mutex_lock(&pHddCtx->tdls_lock);
 
+	pHddTdlsCtx = WLAN_HDD_GET_TDLS_CTX_PTR(pAdapter);
+	if (NULL == pHddTdlsCtx) {
+		/*
+		 * TDLS context can be null and might have been freed up during
+		 * cleanup for STA adapter
+		 */
+		mutex_unlock(&pHddCtx->tdls_lock);
+
+		hdd_info("pHddTdlsCtx is NULL, adapter device mode: %s(%d)",
+			 hdd_device_mode_to_string(pAdapter->device_mode),
+			 pAdapter->device_mode);
+		goto done;
+	}
+
 	/* must stop timer here before freeing peer list, because peerIdleTimer is
 	   part of peer list structure. */
 	wlan_hdd_tdls_timers_destroy(pHddTdlsCtx);
 	wlan_hdd_tdls_free_list(pHddTdlsCtx);
 
-	mutex_unlock(&pHddCtx->tdls_lock);
-
 	wlan_hdd_tdls_free_scan_request(&pHddCtx->tdls_scan_ctxt);
 
 	pHddTdlsCtx->magic = 0;
 	pHddTdlsCtx->pAdapter = NULL;
-
-	qdf_mem_free(pHddTdlsCtx);
 	pAdapter->sessionCtx.station.pHddTdlsCtx = NULL;
-	pHddTdlsCtx = NULL;
 
+	mutex_unlock(&pHddCtx->tdls_lock);
+
+	qdf_mem_free(pHddTdlsCtx);
 done:
 	EXIT();
 	clear_bit(TDLS_INIT_DONE, &pAdapter->event_flags);