Procházet zdrojové kódy

qcacld-3.0: Free radio stats from hdd only

Currently radio stats gets freed from hdd and from wma event
handler as well. This can lead to race condition where if
hdd cb is invoked and immediately another request comes, it
tries to free all the previously allocated radio stats memory
and at the same time wma event handler is also trying to free
the same memory which may lead to double free if both the threads
passes the NULL check at the same time.

To avoid above issue, make a change to free the memory from hdd
only on the receiving of the response and completing the request
and do not free the radio stats memory from wma.

Change-Id: If393ab2d86bce7a833ab9eaf30c34fbe85cdea12
CRs-Fixed: 2972698
Ashish Kumar Dhanotiya před 3 roky
rodič
revize
7e45112171
2 změnil soubory, kde provedl 1 přidání a 3 odebrání
  1. 1 1
      core/hdd/src/wlan_hdd_stats.c
  2. 0 2
      core/wma/src/wma_utils.c

+ 1 - 1
core/hdd/src/wlan_hdd_stats.c

@@ -1964,7 +1964,6 @@ static int wlan_hdd_send_ll_stats_req(struct hdd_adapter *adapter,
 	if (ret) {
 		hdd_err("Target response timed out request id %d request bitmap 0x%x",
 			priv->request_id, priv->request_bitmap);
-		sme_radio_tx_mem_free();
 		qdf_spin_lock(&priv->ll_stats_lock);
 		priv->request_bitmap = 0;
 		qdf_spin_unlock(&priv->ll_stats_lock);
@@ -1972,6 +1971,7 @@ static int wlan_hdd_send_ll_stats_req(struct hdd_adapter *adapter,
 	} else {
 		hdd_update_station_stats_cached_timestamp(adapter);
 	}
+	sme_radio_tx_mem_free();
 	qdf_spin_lock(&priv->ll_stats_lock);
 	status = qdf_list_remove_front(&priv->ll_stats_q, &ll_node);
 	qdf_spin_unlock(&priv->ll_stats_lock);

+ 0 - 2
core/wma/src/wma_utils.c

@@ -2008,7 +2008,6 @@ post_stats:
 		WMA_LINK_LAYER_STATS_RESULTS_RSP,
 		link_stats_results,
 		mac->sme.ll_stats_context);
-	wma_unified_radio_tx_mem_free(handle);
 
 	return 0;
 }
@@ -2314,7 +2313,6 @@ link_radio_stats_cb:
 				     WMA_LINK_LAYER_STATS_RESULTS_RSP,
 				     link_stats_results,
 				     mac->sme.ll_stats_context);
-	wma_unified_radio_tx_mem_free(handle);
 
 	return 0;
 }