Jelajahi Sumber

qcacld-3.0: Take bss peer reference by updating peer ref count

Bss peer reference is taken without updating the ref count.
This is causing a crash if the peer is freed and the pointer
is still maintained resulting in the dangling pointer. Use
correct api to take BSS peer reference.

Change-Id: I732c10cf6339342a1f9716a5c8057085f9b91f68
CRs-Fixed: 3669170
(cherry picked from commit ba2dc0beeb80b98038e3ea478b3ec793868d08ca)
Anuj Khera 1 tahun lalu
induk
melakukan
5fdb90dc62
1 mengubah file dengan 3 tambahan dan 1 penghapusan
  1. 3 1
      components/umac/mlme/mlo_mgr/src/wlan_t2lm_api.c

+ 3 - 1
components/umac/mlme/mlo_mgr/src/wlan_t2lm_api.c

@@ -598,7 +598,8 @@ wlan_t2lm_clear_all_tid_mapping(struct wlan_objmgr_vdev *vdev)
 	}
 
 	t2lm_ctx = &vdev->mlo_dev_ctx->t2lm_ctx;
-	peer = wlan_vdev_get_bsspeer(vdev);
+	peer = wlan_objmgr_vdev_try_get_bsspeer(vdev,
+						WLAN_MLO_MGR_ID);
 	if (!peer) {
 		t2lm_err("peer is null");
 		return;
@@ -626,6 +627,7 @@ wlan_t2lm_clear_all_tid_mapping(struct wlan_objmgr_vdev *vdev)
 	wlan_t2lm_clear_peer_negotiation(peer);
 	wlan_t2lm_clear_ongoing_negotiation(peer);
 	wlan_mlo_t2lm_timer_stop(vdev);
+	wlan_objmgr_peer_release_ref(peer, WLAN_MLO_MGR_ID);
 }
 
 static bool