samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Remove csr_release_command_roam call in csr_roam_issue_connect

Browse Source 
In the function csr_queue_sme_command, we memset the memory for
the roam command to 0 in case of failure and release the memory
to the global command pool. But in csr_roam_issue_connect,
csr_release_command_roam is called again in case of failure,
and this can lead to memset of memory to 0 that is released to
global command pool.

Remove the redundant csr_release_command_roam in the function
csr_roam_issue_connect and the call to csr_reinit_preauth_cmd in
csr_roam_enqueue_preauth.

Change-Id: Ifab3551dd3b2dbb2d135b5488f7b09f422648abb
CRs-Fixed: 2280904
This commit is contained in:
Pragaspathi Thilagaraj
2018-07-27 15:33:15 +05:30
committed by nshrivas
parent 45530e7ce9
commit 7dba4a7af8
3 changed files with 1 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
core/sme/src/csr/csr_api_roam.c
View File

@@ -6610,6 +6610,7 @@ void csr_reinit_roam_cmd(tpAniSirGlobal pMac, tSmeCmd *pCommand)
csr_release_profile(pMac, &pCommand->u.roamCmd.roamProfile); csr_release_profile(pMac, &pCommand->u.roamCmd.roamProfile);
pCommand->u.roamCmd.fReleaseProfile = false; pCommand->u.roamCmd.fReleaseProfile = false;
} }
pCommand->u.roamCmd.pLastRoamBss = NULL;
pCommand->u.roamCmd.pRoamBssEntry = NULL; pCommand->u.roamCmd.pRoamBssEntry = NULL;
/* Because u.roamCmd is union and share with scanCmd and StatusChange */ /* Because u.roamCmd is union and share with scanCmd and StatusChange */
qdf_mem_set(&pCommand->u.roamCmd, sizeof(struct roam_cmd), 0); qdf_mem_set(&pCommand->u.roamCmd, sizeof(struct roam_cmd), 0);
@@ -8652,7 +8653,6 @@ QDF_STATUS csr_roam_issue_connect(tpAniSirGlobal pMac, uint32_t sessionId,
status = csr_queue_sme_command(pMac, pCommand, fImediate); status = csr_queue_sme_command(pMac, pCommand, fImediate);
if (!QDF_IS_STATUS_SUCCESS(status)) { if (!QDF_IS_STATUS_SUCCESS(status)) {
sme_err("fail to send message status: %d", status); sme_err("fail to send message status: %d", status);
csr_release_command_roam(pMac, pCommand);
} }
} }

16
core/sme/src/csr/csr_roam_preauth.c
View File

@@ -35,7 +35,6 @@
#include "wlan_policy_mgr_api.h" #include "wlan_policy_mgr_api.h"
#include "sir_api.h" #include "sir_api.h"
static void csr_reinit_preauth_cmd(tpAniSirGlobal pMac, tSmeCmd *pCommand);
static QDF_STATUS csr_neighbor_roam_add_preauth_fail(tpAniSirGlobal mac_ctx, static QDF_STATUS csr_neighbor_roam_add_preauth_fail(tpAniSirGlobal mac_ctx,
uint8_t session_id, tSirMacAddr bssid); uint8_t session_id, tSirMacAddr bssid);
@@ -92,20 +91,6 @@ void csr_neighbor_roam_tranistion_preauth_done_to_disconnected(
pNeighborRoamInfo->uOsRequestedHandoff = 0; pNeighborRoamInfo->uOsRequestedHandoff = 0;
} }
/**
* csr_reinit_preauth_cmd() - Cleanup the preauth command
* @mac_ctx: Global MAC context
* @command: Command to be cleaned up
*
* Return: None
*/
static void csr_reinit_preauth_cmd(tpAniSirGlobal mac_ctx, tSmeCmd *command)
{
command->u.roamCmd.pLastRoamBss = NULL;
command->u.roamCmd.pRoamBssEntry = NULL;
qdf_mem_set(&command->u.roamCmd, sizeof(struct roam_cmd), 0);
}
/** /**
* csr_roam_enqueue_preauth() - Put the preauth command in the queue * csr_roam_enqueue_preauth() - Put the preauth command in the queue
* @mac_ctx: Global MAC Context * @mac_ctx: Global MAC Context
@@ -138,7 +123,6 @@ QDF_STATUS csr_roam_enqueue_preauth(tpAniSirGlobal mac_ctx,
if (!QDF_IS_STATUS_SUCCESS(status)) { if (!QDF_IS_STATUS_SUCCESS(status)) {
sme_err("fail to queue preauth,status: %d", sme_err("fail to queue preauth,status: %d",
status); status);
csr_reinit_preauth_cmd(mac_ctx, command);
} }
} else { } else {
status = QDF_STATUS_E_RESOURCES; status = QDF_STATUS_E_RESOURCES;

11
core/wma/inc/wma.h
View File

@@ -2889,15 +2889,4 @@ QDF_STATUS wma_config_bmiss_bcnt_params(uint32_t vdev_id, uint32_t first_cnt,
*/ */
void wma_check_and_set_wake_timer(uint32_t time); void wma_check_and_set_wake_timer(uint32_t time);
/**
* wma_vdev_wait_for_peer_delete_completion() - wait for all peers of the vdev
* to be deleted.
* @wma_handle: wma handle
* @vdev_id: vdev id
*
* Return: None
*/
void wma_vdev_wait_for_peer_delete_completion(tp_wma_handle wma_handle,
uint8_t vdev_id);
#endif #endif