samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Use try_get_ref API in wlan_util_get_vdev_by_ifname

Browse Source 
wlan_util_get_vdev_by_ifname currently uses the unconditional vdev ref
grabbing API, wlan_objmgr_vdev_get_ref. Using this API outside of objmgr
core is very dangerous, as a reference to a destroyed vdev can be
obtained, leading to double-free and use-after-free scenarios. Use the
conditional wlan_objmgr_vdev_try_get_ref API instead, and return a NULL
vdev if a reference cannot be obtained.

Change-Id: I44484b664577e6d9a79057ee35150abfb60ca0b3
CRs-Fixed: 2150257
This commit is contained in:
Dustin Brown
2017-11-28 11:02:21 -08:00
committed by snandini
parent 0a297e1b14
commit 74587948ff
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
umac/cmn_services/utils/src/wlan_utility.c
View File

@@ -191,6 +191,7 @@ struct wlan_objmgr_vdev *wlan_util_get_vdev_by_ifname(
struct wlan_objmgr_psoc *psoc, char *ifname, struct wlan_objmgr_psoc *psoc, char *ifname,
wlan_objmgr_ref_dbgid ref_id) wlan_objmgr_ref_dbgid ref_id)
{ {
QDF_STATUS status;
struct wlan_find_vdev_filter filter = {0}; struct wlan_find_vdev_filter filter = {0};
filter.ifname = ifname; filter.ifname = ifname;
@@ -198,8 +199,12 @@ struct wlan_objmgr_vdev *wlan_util_get_vdev_by_ifname(
wlan_util_get_vdev_by_ifname_cb, wlan_util_get_vdev_by_ifname_cb,
&filter, 0, ref_id); &filter, 0, ref_id);
if (filter.found_vdev) if (!filter.found_vdev)
wlan_objmgr_vdev_get_ref(filter.found_vdev, ref_id); return NULL;
status = wlan_objmgr_vdev_try_get_ref(filter.found_vdev, ref_id);
if (QDF_IS_STATUS_ERROR(status))
return NULL;
return filter.found_vdev; return filter.found_vdev;
} }