浏览代码

qcacmn: Fix vdev free issue

At present vdev holds ref cnt on pdev.
The wlan_objmgr_pdev_vdev_detach would trigger:
pdev delete.
So, get psoc from pdev firstly before
wlan_objmgr_pdev_vdev_detach, to avoid accessing
pdev content after free.

Change-Id: I7c1acc15a1dfbffaa81f0b7f827a2686ddaa469f
CRs-Fixed: 2171301
Liangwei Dong 7 年之前
父节点
当前提交
94f906c403
共有 1 个文件被更改,包括 8 次插入3 次删除
  1. 8 3
      umac/cmn_services/obj_mgr/src/wlan_objmgr_vdev_obj.c

+ 8 - 3
umac/cmn_services/obj_mgr/src/wlan_objmgr_vdev_obj.c

@@ -74,6 +74,7 @@ static QDF_STATUS wlan_objmgr_vdev_object_status(
 static QDF_STATUS wlan_objmgr_vdev_obj_free(struct wlan_objmgr_vdev *vdev)
 {
 	struct wlan_objmgr_pdev *pdev;
+	struct wlan_objmgr_psoc *psoc;
 
 	if (vdev == NULL) {
 		obj_mgr_err("vdev is NULL");
@@ -86,6 +87,11 @@ static QDF_STATUS wlan_objmgr_vdev_obj_free(struct wlan_objmgr_vdev *vdev)
 			vdev->vdev_objmgr.vdev_id);
 		return QDF_STATUS_E_FAILURE;
 	}
+	psoc = wlan_pdev_get_psoc(pdev);
+	if (psoc == NULL) {
+		obj_mgr_err("psoc is NULL in pdev");
+		return QDF_STATUS_E_FAILURE;
+	}
 
 	/* Detach VDEV from PDEV VDEV's list */
 	if (wlan_objmgr_pdev_vdev_detach(pdev, vdev) ==
@@ -93,9 +99,8 @@ static QDF_STATUS wlan_objmgr_vdev_obj_free(struct wlan_objmgr_vdev *vdev)
 		return QDF_STATUS_E_FAILURE;
 
 	/* Detach VDEV from PSOC VDEV's list */
-	if (wlan_objmgr_psoc_vdev_detach(
-			pdev->pdev_objmgr.wlan_psoc, vdev) ==
-					QDF_STATUS_E_FAILURE)
+	if (wlan_objmgr_psoc_vdev_detach(psoc, vdev) ==
+					 QDF_STATUS_E_FAILURE)
 		return QDF_STATUS_E_FAILURE;
 
 	qdf_spinlock_destroy(&vdev->vdev_lock);