qcacmn: fix use after free of tx descriptor

In dp_tx_send_msdu_multiple API fix use after
free of tx_desc in case of HW enqueue failed

Change-Id: Iec0375e394c706fa0c39ee18728ac1c02090461c
这个提交包含在:
Chaithanya Garrepalli
2021-02-26 12:32:39 +05:30
提交者 snandini
父节点 f93e080576
当前提交 76112c241f

查看文件

@@ -2316,7 +2316,6 @@ qdf_nbuf_t dp_tx_send_msdu_multiple(struct dp_vdev *vdev, qdf_nbuf_t nbuf,
tid_tx_stats[tx_q->ring_id][msdu_info->tid];
tid_stats->swdrop_cnt[TX_HW_ENQUEUE]++;
dp_tx_desc_release(tx_desc, tx_q->desc_pool_id);
if (msdu_info->frm_type == dp_tx_frm_me) {
hw_enq_fail++;
if (hw_enq_fail == msdu_info->num_seg) {
@@ -2365,6 +2364,7 @@ qdf_nbuf_t dp_tx_send_msdu_multiple(struct dp_vdev *vdev, qdf_nbuf_t nbuf,
continue;
}
dp_tx_desc_release(tx_desc, tx_q->desc_pool_id);
goto done;
}