瀏覽代碼

qcacld-3.0: Check for peer delete in progress before assigning to temp var

With the existing implementation of TAILQ_FOREACH_REVERSE
in ol_txrx_remove_peers_for_vdev() function, host traverses
the list, stores the peer in the var, releases the lock and
later temp var is getting deleted as part of peer unmap and
host end up in accessing the stale peer entry.

To avoid this, host should check the peer delete in progress
first before assigning it to the temp var.

Change-Id: I5b9a401ae062efc6d2fbe608b25424a27c9d9f94
CRs-Fixed: 2159446
Poddar, Siddarth 7 年之前
父節點
當前提交
3f97e3dca7
共有 1 個文件被更改,包括 4 次插入4 次删除
  1. 4 4
      core/dp/txrx/ol_txrx.c

+ 4 - 4
core/dp/txrx/ol_txrx.c

@@ -2964,12 +2964,12 @@ ol_txrx_remove_peers_for_vdev(struct cdp_vdev *pvdev,
 	temp = NULL;
 	TAILQ_FOREACH_REVERSE(peer, &vdev->peer_list, peer_list_t,
 			      peer_list_elem) {
+		if (qdf_atomic_read(&peer->delete_in_progress))
+			continue;
 		if (temp) {
 			qdf_spin_unlock_bh(&vdev->pdev->peer_ref_mutex);
-			if (qdf_atomic_read(&temp->delete_in_progress) == 0) {
-				callback(callback_context, temp->mac_addr.raw,
-					vdev->vdev_id, temp, false);
-			}
+			callback(callback_context, temp->mac_addr.raw,
+				vdev->vdev_id, temp, false);
 			qdf_spin_lock_bh(&vdev->pdev->peer_ref_mutex);
 		}
 		/* self peer is deleted last */