samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Get vdev ref properly in pmo enable/disable RTPM offloads

Browse Source 
vdev object is used without get ref in runtime pm enable/disable offloads
api, this can lead to vdev use after free issue. Add vdev ref get before
using it and avoid vdev use after free.

Change-Id: I309abdd568c858288150f575899101bda06e57a7
CRs-Fixed: 2710759
This commit is contained in:
Rajeev Kumar
2020-06-15 14:17:39 -07:00
committed by nshrivas
parent 5b86a68395
commit 420442623e
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
components/pmo/core/src/wlan_pmo_suspend_resume.c
View File

@@ -433,14 +433,17 @@ static void pmo_core_enable_runtime_pm_offloads(struct wlan_objmgr_psoc *psoc)
{ {
uint8_t vdev_id; uint8_t vdev_id;
struct wlan_objmgr_vdev *vdev; struct wlan_objmgr_vdev *vdev;
QDF_STATUS status;
/* Iterate through VDEV list */ /* Iterate through VDEV list */
for (vdev_id = 0; vdev_id < WLAN_UMAC_PSOC_MAX_VDEVS; vdev_id++) { for (vdev_id = 0; vdev_id < WLAN_UMAC_PSOC_MAX_VDEVS; vdev_id++) {
vdev = pmo_psoc_get_vdev(psoc, vdev_id); vdev = pmo_psoc_get_vdev(psoc, vdev_id);
if (!vdev) status = pmo_vdev_get_ref(vdev);
if (QDF_IS_STATUS_ERROR(status))
continue; continue;
pmo_register_action_frame_patterns(vdev, QDF_RUNTIME_SUSPEND); pmo_register_action_frame_patterns(vdev, QDF_RUNTIME_SUSPEND);
pmo_vdev_put_ref(vdev);
} }
} }
@@ -448,14 +451,17 @@ static void pmo_core_disable_runtime_pm_offloads(struct wlan_objmgr_psoc *psoc)
{ {
uint8_t vdev_id; uint8_t vdev_id;
struct wlan_objmgr_vdev *vdev; struct wlan_objmgr_vdev *vdev;
QDF_STATUS status;
/* Iterate through VDEV list */ /* Iterate through VDEV list */
for (vdev_id = 0; vdev_id < WLAN_UMAC_PSOC_MAX_VDEVS; vdev_id++) { for (vdev_id = 0; vdev_id < WLAN_UMAC_PSOC_MAX_VDEVS; vdev_id++) {
vdev = pmo_psoc_get_vdev(psoc, vdev_id); vdev = pmo_psoc_get_vdev(psoc, vdev_id);
if (!vdev) status = pmo_vdev_get_ref(vdev);
if (QDF_IS_STATUS_ERROR(status))
continue; continue;
pmo_clear_action_frame_patterns(vdev); pmo_clear_action_frame_patterns(vdev);
pmo_vdev_put_ref(vdev);
} }
} }