فهرست منبع

qcacmn: resolve race between vdev create and wifi_pos_get_vdev_count

In function wifi_pos_process_app_reg_req(), it uses function
wifi_pos_get_vdev_count to get vdev_count;
Then wifi_pos_process_app_reg_req->
     wifi_pos_get_vdev_list-> wlan_objmgr_iterate_obj_list,
it uses wlan_psoc_get_max_vdev_count to get max_vdev_cnt,
if vdev is not NULL, it invokes function wifi_pos_vdev_iterator
to fill the vdev_info.

For the failure scenario:
In wifi_pos_process_app_reg_req, it gets 2 for vdev_count
from function wifi_pos_get_vdev_count; Then the process is
interrupted and vdev 2 is created in another process; Now
since there are vdev 0, 1, 2, wifi_pos_vdev_iterator is
called 3 times and memory corruption happens since it writes
two more bytes with op mode and vdev id in vdev_info.

Change-Id: I5222836a1448bfaa7df31c919419d448eaa20895
CRs-Fixed: 3320183
Paul Zhang 2 سال پیش
والد
کامیت
47c7d6990d
1فایلهای تغییر یافته به همراه2 افزوده شده و 2 حذف شده
  1. 2 2
      umac/wifi_pos/src/wifi_pos_main.c

+ 2 - 2
umac/wifi_pos/src/wifi_pos_main.c

@@ -757,7 +757,7 @@ static void wifi_pos_get_vdev_list(struct wlan_objmgr_psoc *psoc,
 
 static uint32_t wifi_pos_get_vdev_count(struct wlan_objmgr_psoc *psoc)
 {
-	return psoc->soc_objmgr.wlan_vdev_count;
+	return psoc->soc_objmgr.max_vdev_count;
 }
 
 #else
@@ -790,7 +790,7 @@ static uint32_t wifi_pos_get_vdev_count(struct wlan_objmgr_psoc *tpsoc)
 	for (index = 0; index < WLAN_OBJMGR_MAX_DEVICES; index++) {
 		if (g_umac_glb_obj->psoc[index]) {
 			psoc = g_umac_glb_obj->psoc[index];
-			vdev_count += psoc->soc_objmgr.wlan_vdev_count;
+			vdev_count += psoc->soc_objmgr.max_vdev_count;
 		}
 	}