samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Stop TDLS peer_discovery_timer

Browse Source 
For MLO TDLS, the discovery request frame is sent on
different links and peer_discovery_timer is started to
receive the discovery response frames from different
links.

One race condition is: the timer is running and then
vdev destroy happens. Then the timer callback could not
get the right pointer when timer is triggered.

To resolve this issue, stop the timer in the function
tdls_vdev_obj_destroy_notification.

Change-Id: I0b7aff14a599229cb5848b0b7eb9d2af53e6ad94
CRs-Fixed: 3554466
This commit is contained in:
Paul Zhang
2023-07-11 16:27:56 +08:00
committed by Rahul Choudhary
parent f7864c0c78
commit 3e9f7d3d0e
2 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
components/tdls/core/src/wlan_tdls_ct.c
View File

@@ -105,6 +105,9 @@ void tdls_discovery_timeout_peer_cb(void *user_data)
vdev = (struct wlan_objmgr_vdev *)user_data;
tdls_soc = wlan_vdev_get_tdls_soc_obj(vdev);
if (!tdls_soc)
return;
if (wlan_vdev_mlme_is_mlo_vdev(vdev) &&
qdf_atomic_dec_and_test(&tdls_soc->timer_cnt)) {
tdls_process_mlo_cal_tdls_link_score(vdev);
@@ -144,6 +147,9 @@ void tdls_discovery_timeout_peer_cb(void *user_data)
}
tdls_vdev = wlan_vdev_get_tdls_vdev_obj(vdev);
if (!tdls_vdev)
return;
for (i = 0; i < WLAN_TDLS_PEER_LIST_SIZE; i++) {
head = &tdls_vdev->peer_list[i];
status = qdf_list_peek_front(head, &p_node);

7
components/tdls/core/src/wlan_tdls_main.c
View File

@@ -346,6 +346,13 @@ QDF_STATUS tdls_vdev_obj_destroy_notification(struct wlan_objmgr_vdev *vdev,
return QDF_STATUS_E_FAILURE;
}
if (wlan_vdev_mlme_is_mlo_vdev(vdev)) {
if (QDF_TIMER_STATE_STOPPED !=
qdf_mc_timer_get_current_state(
&tdls_vdev_obj->peer_discovery_timer))
qdf_mc_timer_stop(&tdls_vdev_obj->peer_discovery_timer);
}
qdf_event_destroy(&tdls_vdev_obj->tdls_teardown_comp);
tdls_vdev_deinit(tdls_vdev_obj);