소스 검색

qcacld-3.0: Prevent rx hashlist access after rx hash deinit

Rx hash deinit sets hash_table to NULL, at the same time
there can be active tasklet context accessing the rx hash list.
Prevent rx hashlist access after rx hash deinit and set the netbuf
to NULL once netbuff is popped out of the list.

Change-Id: I4e30dd69ece33c3cc768842274d5307c0bf29a37
CRs-Fixed: 2049121
Govind Singh 8 년 전
부모
커밋
9ad8414613
1개의 변경된 파일7개의 추가작업 그리고 0개의 파일을 삭제
  1. 7 0
      core/dp/htt/htt_rx.c

+ 7 - 0
core/dp/htt/htt_rx.c

@@ -3214,6 +3214,9 @@ qdf_nbuf_t htt_rx_hash_list_lookup(struct htt_pdev_t *pdev,
 
 	qdf_spin_lock_bh(&(pdev->rx_ring.rx_hash_lock));
 
+	if (!pdev->rx_ring.hash_table)
+		return NULL;
+
 	i = RX_HASH_FUNCTION(paddr);
 
 	HTT_LIST_ITER_FWD(list_iter, &pdev->rx_ring.hash_table[i]->listhead) {
@@ -3226,6 +3229,10 @@ qdf_nbuf_t htt_rx_hash_list_lookup(struct htt_pdev_t *pdev,
 		if (hash_entry->paddr == paddr) {
 			/* Found the entry corresponding to paddr */
 			netbuf = hash_entry->netbuf;
+			/* set netbuf to NULL to trace if freed entry
+			 * is getting unmapped in hash deinit.
+			 */
+			hash_entry->netbuf = NULL;
 			htt_list_remove(&hash_entry->listnode);
 			HTT_RX_HASH_COUNT_DECR(pdev->rx_ring.hash_table[i]);
 			/*