samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Fix crash in TDLS functionality

Browse Source 
qcacld-2.0 to qcacld-3.0 propagation

Currently, tdls lock has not been acquired and if tdls peer or
tdls context freed in other context then it will lead to crash.
Fix is to ensure that the tdls lock is acquired for tdls peer
list and tdls context.

Change-Id: I52c3e7b67c7f61160c54a1a6688db09f0137b7e1
CRs-Fixed: 945302
This commit is contained in:
Masti, Narayanraddi
2016-09-14 16:36:37 +05:30
committed by Gerrit - the friendly Code Review server
parent aaf16a4c5e
commit 27fbec7970
1 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
core/hdd/src/wlan_hdd_tdls.c
View File

@@ -874,22 +874,34 @@ void wlan_hdd_tdls_exit(hdd_adapter_t *pAdapter)
mutex_lock(&pHddCtx->tdls_lock); mutex_lock(&pHddCtx->tdls_lock);
pHddTdlsCtx = WLAN_HDD_GET_TDLS_CTX_PTR(pAdapter);
if (NULL == pHddTdlsCtx) {
/*
* TDLS context can be null and might have been freed up during
* cleanup for STA adapter
*/
mutex_unlock(&pHddCtx->tdls_lock);
hdd_info("pHddTdlsCtx is NULL, adapter device mode: %s(%d)",
hdd_device_mode_to_string(pAdapter->device_mode),
pAdapter->device_mode);
goto done;
}
/* must stop timer here before freeing peer list, because peerIdleTimer is /* must stop timer here before freeing peer list, because peerIdleTimer is
part of peer list structure. */ part of peer list structure. */
wlan_hdd_tdls_timers_destroy(pHddTdlsCtx); wlan_hdd_tdls_timers_destroy(pHddTdlsCtx);
wlan_hdd_tdls_free_list(pHddTdlsCtx); wlan_hdd_tdls_free_list(pHddTdlsCtx);
mutex_unlock(&pHddCtx->tdls_lock);
wlan_hdd_tdls_free_scan_request(&pHddCtx->tdls_scan_ctxt); wlan_hdd_tdls_free_scan_request(&pHddCtx->tdls_scan_ctxt);
pHddTdlsCtx->magic = 0; pHddTdlsCtx->magic = 0;
pHddTdlsCtx->pAdapter = NULL; pHddTdlsCtx->pAdapter = NULL;
pAdapter->sessionCtx.station.pHddTdlsCtx = NULL;
mutex_unlock(&pHddCtx->tdls_lock);
qdf_mem_free(pHddTdlsCtx); qdf_mem_free(pHddTdlsCtx);
pAdapter->sessionCtx.station.pHddTdlsCtx = NULL;
pHddTdlsCtx = NULL;
done: done:
EXIT(); EXIT();
clear_bit(TDLS_INIT_DONE, &pAdapter->event_flags); clear_bit(TDLS_INIT_DONE, &pAdapter->event_flags);