Эх сурвалжийг харах

qcacmn: avoid of HTC buffer double free in HTC send failure case

HTC buffer is freed in enqueue failure case. Then it is requeued to
htt_htc_pkt_misclist also. In deinit flow, misclist entry should be
cleared, so buffer double free is hit in this stage. Make a change
to not requeue this frame to misclist.

Change-Id: I0211c4b548d7df7176ee72a83e21f8fcf7fa464c
CRs-Fixed: 2942972
Yu Tian 4 жил өмнө
parent
commit
73de559075

+ 5 - 1
dp/wifi3.0/dp_htt.c

@@ -50,6 +50,10 @@
 #define HTT_SHIFT_UPPER_TIMESTAMP 32
 #define HTT_SHIFT_UPPER_TIMESTAMP 32
 #define HTT_MASK_UPPER_TIMESTAMP 0xFFFFFFFF00000000
 #define HTT_MASK_UPPER_TIMESTAMP 0xFFFFFFFF00000000
 
 
+#define HTT_HTC_PKT_STATUS_SUCCESS \
+	((pkt->htc_pkt.Status != QDF_STATUS_E_CANCELED) && \
+	(pkt->htc_pkt.Status != QDF_STATUS_E_RESOURCES))
+
 /*
 /*
  * dp_htt_get_ppdu_sniffer_ampdu_tlv_bitmap() - Get ppdu stats tlv
  * dp_htt_get_ppdu_sniffer_ampdu_tlv_bitmap() - Get ppdu stats tlv
  * bitmap for sniffer mode
  * bitmap for sniffer mode
@@ -682,7 +686,7 @@ static inline QDF_STATUS DP_HTT_SEND_HTC_PKT(struct htt_soc *soc,
 	htt_command_record(soc->htt_logger_handle, cmd, buf);
 	htt_command_record(soc->htt_logger_handle, cmd, buf);
 
 
 	status = htc_send_pkt(soc->htc_soc, &pkt->htc_pkt);
 	status = htc_send_pkt(soc->htc_soc, &pkt->htc_pkt);
-	if (status == QDF_STATUS_SUCCESS)
+	if (status == QDF_STATUS_SUCCESS && HTT_HTC_PKT_STATUS_SUCCESS)
 		htt_htc_misc_pkt_list_add(soc, pkt);
 		htt_htc_misc_pkt_list_add(soc, pkt);
 	else
 	else
 		soc->stats.fail_count++;
 		soc->stats.fail_count++;