samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: set mpdu next to null during msdu stitching

Browse Source 
In monitor mode, when we try to stitch msdus together into an ampdu
to be sent to the stack (dp_rx_mon_restitch_mpdu_from_msdus),
we aggregate them together via frag_list. In the current code,
for the first msdu in which the frag_list is populated (if there are
more than one msdus to be sent to stack), the next pointer (skb->next)
is not set to NULL. This causes the HDD code to process the next
pointer leading to issues double free issues.

Set the next pointer for the first msdu(with frag_list) to NULL.

Change-Id: I60d1d463c7bbb602e4b199fbb691340ad6247bc5
CRs-Fixed: 2173405
This commit is contained in:
Mohit Khanna
2018-01-16 16:04:05 -08:00
committed by snandini
parent d3478efb89
commit 33ed0312fa
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
dp/wifi3.0/dp_rx_mon_dest.c
View File

@@ -416,6 +416,7 @@ qdf_nbuf_t dp_rx_mon_restitch_mpdu_from_msdus(struct dp_soc *soc,
frag_list_sum_len -= HAL_RX_FCS_LEN; frag_list_sum_len -= HAL_RX_FCS_LEN;
qdf_nbuf_append_ext_list(mpdu_buf, head_frag_list, qdf_nbuf_append_ext_list(mpdu_buf, head_frag_list,
frag_list_sum_len); frag_list_sum_len);
qdf_nbuf_set_next(mpdu_buf, NULL);
} }
goto mpdu_stitch_done; goto mpdu_stitch_done;