Explorar o código

qcacld-3.0: Check for peer delete in progress before assigning to temp var

With the existing implementation of TAILQ_FOREACH_REVERSE
in ol_txrx_remove_peers_for_vdev() function, host traverses
the list, stores the peer in the var, releases the lock and
later temp var is getting deleted as part of peer unmap and
host end up in accessing the stale peer entry.

To avoid this, host should check the peer delete in progress
first before assigning it to the temp var.

Change-Id: I5b9a401ae062efc6d2fbe608b25424a27c9d9f94
CRs-Fixed: 2159446
Poddar, Siddarth %!s(int64=7) %!d(string=hai) anos
pai
achega
3f97e3dca7
Modificáronse 1 ficheiros con 4 adicións e 4 borrados
  1. 4 4
      core/dp/txrx/ol_txrx.c

+ 4 - 4
core/dp/txrx/ol_txrx.c

@@ -2964,12 +2964,12 @@ ol_txrx_remove_peers_for_vdev(struct cdp_vdev *pvdev,
 	temp = NULL;
 	TAILQ_FOREACH_REVERSE(peer, &vdev->peer_list, peer_list_t,
 			      peer_list_elem) {
+		if (qdf_atomic_read(&peer->delete_in_progress))
+			continue;
 		if (temp) {
 			qdf_spin_unlock_bh(&vdev->pdev->peer_ref_mutex);
-			if (qdf_atomic_read(&temp->delete_in_progress) == 0) {
-				callback(callback_context, temp->mac_addr.raw,
-					vdev->vdev_id, temp, false);
-			}
+			callback(callback_context, temp->mac_addr.raw,
+				vdev->vdev_id, temp, false);
 			qdf_spin_lock_bh(&vdev->pdev->peer_ref_mutex);
 		}
 		/* self peer is deleted last */