瀏覽代碼

qcacmn: Do not add nbuf to emerg_nbuf_q on free when not initialized

When nbuf is freed via dp_rx_buffer_pool_nbuf_free, the
nbuf is enqueued to emerg_nbuf_q always even in the case
where the emerg_nbuf_q is not initialized. This will result
in NULL pointer dereference when any nbuf is enqueued to
emerg_nbuf_q.

Fix is to add initialization check before adding the nbuf
to emerg_nbuf_q and free the nbuf if emerg_nbuf_q is not
initialized.

Change-Id: I075b3b93203eec21d44ea3967b5f46d59c291a14
CRs-Fixed: 2934593
Yeshwanth Sriram Guntuka 4 年之前
父節點
當前提交
43e51ba3d8
共有 1 個文件被更改,包括 2 次插入1 次删除
  1. 2 1
      dp/wifi3.0/dp_rx_buffer_pool.c

+ 2 - 1
dp/wifi3.0/dp_rx_buffer_pool.c

@@ -110,7 +110,8 @@ void dp_rx_buffer_pool_nbuf_free(struct dp_soc *soc, qdf_nbuf_t nbuf, u8 mac_id)
 	buff_pool = &soc->rx_buff_pool[mac_id];
 
 	if (qdf_likely(qdf_nbuf_queue_head_qlen(&buff_pool->emerg_nbuf_q) >=
-		       DP_RX_BUFFER_POOL_SIZE))
+		       DP_RX_BUFFER_POOL_SIZE) ||
+	    !buff_pool->is_initialized)
 		return qdf_nbuf_free(nbuf);
 
 	qdf_nbuf_reset(nbuf, RX_BUFFER_RESERVATION,