Преглед на файлове

qcacld-3.0: Fix race condition when accessing vdev peer list

While one thread delete peer from vdev peer list, set entry's next as
itself, another thread accesses the deleting entry of the peer list,
and access it's next, deadloop and use after free will happen.

To fix it, add vdev lock when access vdev peer list, same as delete peer
from vdev peer list.

wlan_obj_vdev_peerlist_remove_peer
qdf_list_remove_node
->list_del_init
->INIT_LIST_HEAD
->WRITE_ONCE(list->next, list);

Change-Id: Icc288035837869e73c247837a24785f70822d671
CRs-Fixed: 3200030
Jianmin Zhu преди 2 години
родител
ревизия
9426a796bb
променени са 1 файла, в които са добавени 2 реда и са изтрити 0 реда
  1. 2 0
      core/hdd/src/wlan_hdd_main.c

+ 2 - 0
core/hdd/src/wlan_hdd_main.c

@@ -3960,6 +3960,7 @@ static void hdd_check_for_objmgr_peer_leaks(struct wlan_objmgr_psoc *psoc)
 
 	/* get module id which cause the leak and release ref */
 	wlan_objmgr_for_each_psoc_vdev(psoc, vdev_id, vdev) {
+		wlan_vdev_obj_lock(vdev);
 		wlan_objmgr_for_each_vdev_peer(vdev, peer) {
 			qdf_atomic_t *ref_id_dbg;
 			int ref_id;
@@ -3969,6 +3970,7 @@ static void hdd_check_for_objmgr_peer_leaks(struct wlan_objmgr_psoc *psoc)
 			wlan_objmgr_for_each_refs(ref_id_dbg, ref_id, refs)
 				wlan_objmgr_peer_release_ref(peer, ref_id);
 		}
+		wlan_vdev_obj_unlock(vdev);
 	}
 }