samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: fix use after free of tx descriptor

Browse Source 
In dp_tx_send_msdu_multiple API fix use after
free of tx_desc in case of HW enqueue failed

Change-Id: Iec0375e394c706fa0c39ee18728ac1c02090461c
This commit is contained in:
Chaithanya Garrepalli
2021-02-26 12:32:39 +05:30
committed by snandini
parent f93e080576
commit 76112c241f
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
dp/wifi3.0/dp_tx.c
View File

@@ -2316,7 +2316,6 @@ qdf_nbuf_t dp_tx_send_msdu_multiple(struct dp_vdev *vdev, qdf_nbuf_t nbuf,
tid_tx_stats[tx_q->ring_id][msdu_info->tid]; tid_tx_stats[tx_q->ring_id][msdu_info->tid];
tid_stats->swdrop_cnt[TX_HW_ENQUEUE]++; tid_stats->swdrop_cnt[TX_HW_ENQUEUE]++;
dp_tx_desc_release(tx_desc, tx_q->desc_pool_id);
if (msdu_info->frm_type == dp_tx_frm_me) { if (msdu_info->frm_type == dp_tx_frm_me) {
hw_enq_fail++; hw_enq_fail++;
if (hw_enq_fail == msdu_info->num_seg) { if (hw_enq_fail == msdu_info->num_seg) {
@@ -2365,6 +2364,7 @@ qdf_nbuf_t dp_tx_send_msdu_multiple(struct dp_vdev *vdev, qdf_nbuf_t nbuf,
continue; continue;
} }
dp_tx_desc_release(tx_desc, tx_q->desc_pool_id);
goto done; goto done;
} }