samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Fix double free in MEC notify event

Browse Source 
Fix double free of tx descriptors with MEC notify
event

Change-Id: I7456b14e8872fd7732afade7d49134c1fca9284b
This commit is contained in:
Chaithanya Garrepalli
2021-12-24 10:35:18 +05:30
committed by Madan Koyyalamudi
parent 0156c41d12
commit 9764cf5e3d
2 changed files with 31 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
dp/wifi3.0/be/dp_be_tx.c
View File

@@ -152,11 +152,8 @@ void dp_tx_process_mec_notify_be(struct dp_soc *soc, uint8_t *status)
{ {
struct dp_vdev *vdev; struct dp_vdev *vdev;
uint8_t vdev_id; uint8_t vdev_id;
uint8_t tx_status;
uint32_t *htt_desc = (uint32_t *)status; uint32_t *htt_desc = (uint32_t *)status;
tx_status = HTT_TX_WBM_COMPLETION_V3_TX_STATUS_GET(htt_desc[0]);
if (tx_status == HTT_TX_FW2WBM_TX_STATUS_MEC_NOTIFY) {
qdf_assert_always(!soc->mec_fw_offload); qdf_assert_always(!soc->mec_fw_offload);
/* /*
@@ -174,7 +171,6 @@ void dp_tx_process_mec_notify_be(struct dp_soc *soc, uint8_t *status)
dp_tx_mec_handler(vdev, status); dp_tx_mec_handler(vdev, status);
dp_vdev_unref_delete(soc, vdev, DP_MOD_ID_HTT_COMP); dp_vdev_unref_delete(soc, vdev, DP_MOD_ID_HTT_COMP);
} }
}
void dp_tx_process_htt_completion_be(struct dp_soc *soc, void dp_tx_process_htt_completion_be(struct dp_soc *soc,
struct dp_tx_desc_s *tx_desc, struct dp_tx_desc_s *tx_desc,
@@ -201,7 +197,8 @@ void dp_tx_process_htt_completion_be(struct dp_soc *soc,
* notification comes from FW2WBM. Avoid access any field of tx * notification comes from FW2WBM. Avoid access any field of tx
* descriptor in case of MEC notify. * descriptor in case of MEC notify.
*/ */
dp_tx_process_mec_notify_be(soc, status); if (tx_status == HTT_TX_FW2WBM_TX_STATUS_MEC_NOTIFY)
return dp_tx_process_mec_notify_be(soc, status);
/* /*
* If the descriptor is already freed in vdev_detach, * If the descriptor is already freed in vdev_detach,

7
dp/wifi3.0/li/dp_li_tx.c
View File

@@ -65,11 +65,8 @@ void dp_tx_process_mec_notify_li(struct dp_soc *soc, uint8_t *status)
{ {
struct dp_vdev *vdev; struct dp_vdev *vdev;
uint8_t vdev_id; uint8_t vdev_id;
uint8_t tx_status;
uint32_t *htt_desc = (uint32_t *)status; uint32_t *htt_desc = (uint32_t *)status;
tx_status = HTT_TX_WBM_COMPLETION_V2_TX_STATUS_GET(htt_desc[0]);
if (tx_status == HTT_TX_FW2WBM_TX_STATUS_MEC_NOTIFY) {
/* /*
* Get vdev id from HTT status word in case of MEC * Get vdev id from HTT status word in case of MEC
* notification * notification
@@ -85,7 +82,6 @@ void dp_tx_process_mec_notify_li(struct dp_soc *soc, uint8_t *status)
dp_tx_mec_handler(vdev, status); dp_tx_mec_handler(vdev, status);
dp_vdev_unref_delete(soc, vdev, DP_MOD_ID_HTT_COMP); dp_vdev_unref_delete(soc, vdev, DP_MOD_ID_HTT_COMP);
} }
}
void dp_tx_process_htt_completion_li(struct dp_soc *soc, void dp_tx_process_htt_completion_li(struct dp_soc *soc,
struct dp_tx_desc_s *tx_desc, struct dp_tx_desc_s *tx_desc,
@@ -112,7 +108,8 @@ void dp_tx_process_htt_completion_li(struct dp_soc *soc,
* notification comes from FW2WBM. Avoid access any field of tx * notification comes from FW2WBM. Avoid access any field of tx
* descriptor in case of MEC notify. * descriptor in case of MEC notify.
*/ */
dp_tx_process_mec_notify_li(soc, status); if (tx_status == HTT_TX_FW2WBM_TX_STATUS_MEC_NOTIFY)
return dp_tx_process_mec_notify_li(soc, status);
/* /*
* If the descriptor is already freed in vdev_detach, * If the descriptor is already freed in vdev_detach,