samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Check for peer delete in progress before assigning to temp var

Browse Source 
With the existing implementation of TAILQ_FOREACH_REVERSE
in ol_txrx_remove_peers_for_vdev() function, host traverses
the list, stores the peer in the var, releases the lock and
later temp var is getting deleted as part of peer unmap and
host end up in accessing the stale peer entry.

To avoid this, host should check the peer delete in progress
first before assigning it to the temp var.

Change-Id: I5b9a401ae062efc6d2fbe608b25424a27c9d9f94
CRs-Fixed: 2159446
This commit is contained in:
Poddar, Siddarth
2017-12-18 15:11:13 +05:30
committed by snandini
parent f939162569
commit 3f97e3dca7
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
core/dp/txrx/ol_txrx.c
View File

@@ -2964,12 +2964,12 @@ ol_txrx_remove_peers_for_vdev(struct cdp_vdev *pvdev,
temp = NULL; temp = NULL;
TAILQ_FOREACH_REVERSE(peer, &vdev->peer_list, peer_list_t, TAILQ_FOREACH_REVERSE(peer, &vdev->peer_list, peer_list_t,
peer_list_elem) { peer_list_elem) {
if (qdf_atomic_read(&peer->delete_in_progress))
continue;
if (temp) { if (temp) {
qdf_spin_unlock_bh(&vdev->pdev->peer_ref_mutex); qdf_spin_unlock_bh(&vdev->pdev->peer_ref_mutex);
if (qdf_atomic_read(&temp->delete_in_progress) == 0) { callback(callback_context, temp->mac_addr.raw,
callback(callback_context, temp->mac_addr.raw, vdev->vdev_id, temp, false);
vdev->vdev_id, temp, false);
}
qdf_spin_lock_bh(&vdev->pdev->peer_ref_mutex); qdf_spin_lock_bh(&vdev->pdev->peer_ref_mutex);
} }
/* self peer is deleted last */ /* self peer is deleted last */