Browse Source

qcacmn: Acquire nbuf meta lock during free

qdf_nbuf_free_debug() does a hashtable lookup for nbuf metadata without
grabbing the appropriate spinlock. This naturally leads to a variety of
issues. Acquire the nbuf metadata lock while accessing the metadata
hashtable in qdf_nbuf_free_debug().

Change-Id: I058b00abcf0162c764fc9ad5011be341a07f2b9d
CRs-Fixed: 2288522
Dustin Brown 6 years ago
parent
commit
427357d954
1 changed files with 2 additions and 0 deletions
  1. 2 0
      qdf/linux/src/qdf_nbuf.c

+ 2 - 0
qdf/linux/src/qdf_nbuf.c

@@ -2640,11 +2640,13 @@ void qdf_nbuf_free_debug(qdf_nbuf_t nbuf, uint8_t *file, uint32_t line)
 	if (qdf_likely(nbuf)) {
 		struct qdf_nbuf_map_metadata *meta;
 
+		qdf_spin_lock_irqsave(&qdf_nbuf_map_lock);
 		meta = qdf_nbuf_meta_get(nbuf);
 		if (meta)
 			QDF_DEBUG_PANIC(
 				"Nbuf freed @ %s:%u while mapped from %s:%u",
 				kbasename(file), line, meta->file, meta->line);
+		qdf_spin_unlock_irqrestore(&qdf_nbuf_map_lock);
 
 		qdf_net_buf_debug_delete_node(nbuf);
 		qdf_nbuf_history_add(nbuf, file, line, QDF_NBUF_FREE);