qcacld-3.0: htc: Fix race while processing HTC control messages
HTC control messages ready and connect service indications use CtrlResponseBuffer for processing the HTC messages. Flag CtrlResponseProcessing is used to protect this buffer from overwriting before processing. Current implementation has race condition as setting the flag happens on waiting thread context instead of receive thread context so this could lead to overwriting the CtrlResponseBuffer if waiting thread doesn't get chance to run because of may be another RX interrupt. Also to catch this kind of issues, add CDF_BUG so that it is easier to triage the cause for the malformed packet which is not expected. CRs-fixed: 881504 Change-Id: Ia279e08c761a3432cf01d4dc129f7b5439d04680
Esse commit está contido em:

commit de
Prakash Dhavali

pai
b976119f9b
commit
5304757ef5
@@ -418,6 +418,7 @@ CDF_STATUS htc_rx_completion_handler(void *Context, cdf_nbuf_t netbuf,
|
||||
AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
|
||||
("HTC Rx Ctrl still processing\n"));
|
||||
status = CDF_STATUS_E_FAILURE;
|
||||
CDF_BUG(false);
|
||||
break;
|
||||
}
|
||||
|
||||
@@ -427,6 +428,9 @@ CDF_STATUS htc_rx_completion_handler(void *Context, cdf_nbuf_t netbuf,
|
||||
HTC_MAX_CONTROL_MESSAGE_LENGTH);
|
||||
A_MEMCPY(target->CtrlResponseBuffer, netdata,
|
||||
target->CtrlResponseLength);
|
||||
|
||||
/* Requester will clear this flag */
|
||||
target->CtrlResponseProcessing = true;
|
||||
UNLOCK_HTC_RX(target);
|
||||
|
||||
cdf_semaphore_release(target->osdev,
|
||||
|
Referência em uma nova issue
Block a user