瀏覽代碼

qcacld-3.0: Don't process scan command when vdev delete is in process

When driver performs vdev delete operation, it changes vdev state
to logically deleted or physically deleted only after receiving vdev
delete command's response from FW. In between (sending vdev del req
and receiving vdev del rsp) if thread gets pre-empted and other thread
start posting command (like scan command) to process then it could
lead to use after free scenario.

Notify scan component when vdev delete is intiated and let scan
component record that in to vdev's scan private object as one of the
flags.

check this flag before processing the scan command.

CRs-Fixed: 2265542
Change-Id: Id884d6c42cd8766e70835808863632e096158487
Krunal Soni 6 年之前
父節點
當前提交
8a06d83ca8
共有 1 個文件被更改,包括 2 次插入0 次删除
  1. 2 0
      core/hdd/src/wlan_hdd_main.c

+ 2 - 0
core/hdd/src/wlan_hdd_main.c

@@ -3852,6 +3852,7 @@ int hdd_vdev_destroy(struct hdd_adapter *adapter)
 		return -EINVAL;
 	}
 	status = ucfg_reg_11d_vdev_delete_update(adapter->hdd_vdev);
+	ucfg_scan_set_vdev_del_in_progress(adapter->hdd_vdev);
 
 	/* close sme session (destroy vdev in firmware via legacy API) */
 	qdf_event_reset(&adapter->qdf_session_close_event);
@@ -3888,6 +3889,7 @@ int hdd_vdev_destroy(struct hdd_adapter *adapter)
 	}
 
 release_vdev:
+	ucfg_scan_clear_vdev_del_in_progress(adapter->hdd_vdev);
 	/*
 	 * In SSR or driver unloading case, directly exit may cause objects
 	 * leak, if sme_close_session failed. Free objects anyway.