Browse Source

qcacmn: fix use after free of tx descriptor

In dp_tx_send_msdu_multiple API fix use after
free of tx_desc in case of HW enqueue failed

Change-Id: Iec0375e394c706fa0c39ee18728ac1c02090461c
Chaithanya Garrepalli 4 years ago
parent
commit
76112c241f
1 changed files with 1 additions and 1 deletions
  1. 1 1
      dp/wifi3.0/dp_tx.c

+ 1 - 1
dp/wifi3.0/dp_tx.c

@@ -2316,7 +2316,6 @@ qdf_nbuf_t dp_tx_send_msdu_multiple(struct dp_vdev *vdev, qdf_nbuf_t nbuf,
 				    tid_tx_stats[tx_q->ring_id][msdu_info->tid];
 				    tid_tx_stats[tx_q->ring_id][msdu_info->tid];
 			tid_stats->swdrop_cnt[TX_HW_ENQUEUE]++;
 			tid_stats->swdrop_cnt[TX_HW_ENQUEUE]++;
 
 
-			dp_tx_desc_release(tx_desc, tx_q->desc_pool_id);
 			if (msdu_info->frm_type == dp_tx_frm_me) {
 			if (msdu_info->frm_type == dp_tx_frm_me) {
 				hw_enq_fail++;
 				hw_enq_fail++;
 				if (hw_enq_fail == msdu_info->num_seg) {
 				if (hw_enq_fail == msdu_info->num_seg) {
@@ -2365,6 +2364,7 @@ qdf_nbuf_t dp_tx_send_msdu_multiple(struct dp_vdev *vdev, qdf_nbuf_t nbuf,
 				continue;
 				continue;
 			}
 			}
 
 
+			dp_tx_desc_release(tx_desc, tx_q->desc_pool_id);
 			goto done;
 			goto done;
 		}
 		}