Prechádzať zdrojové kódy

qcacld-3.0: htc: Fix race while processing HTC control messages

HTC control messages ready and connect service indications use
CtrlResponseBuffer for processing the HTC messages. Flag
CtrlResponseProcessing is used to protect this buffer from
overwriting before processing. Current implementation has race
condition as setting the flag happens on waiting thread context
instead of receive thread context so this could lead to
overwriting the CtrlResponseBuffer if waiting thread doesn't get
chance to run because of may be another RX interrupt.
Also to catch this kind of issues, add CDF_BUG so that it is
easier to triage the cause for the malformed packet which is not
expected.

CRs-fixed: 881504
Change-Id: Ia279e08c761a3432cf01d4dc129f7b5439d04680
Prashanth Bhatta 9 rokov pred
rodič
commit
9dddcb2745
1 zmenil súbory, kde vykonal 4 pridanie a 0 odobranie
  1. 4 0
      core/htc/htc_recv.c

+ 4 - 0
core/htc/htc_recv.c

@@ -418,6 +418,7 @@ CDF_STATUS htc_rx_completion_handler(void *Context, cdf_nbuf_t netbuf,
 					AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
 							("HTC Rx Ctrl still processing\n"));
 					status = CDF_STATUS_E_FAILURE;
+					CDF_BUG(false);
 					break;
 				}
 
@@ -427,6 +428,9 @@ CDF_STATUS htc_rx_completion_handler(void *Context, cdf_nbuf_t netbuf,
 					    HTC_MAX_CONTROL_MESSAGE_LENGTH);
 				A_MEMCPY(target->CtrlResponseBuffer, netdata,
 					 target->CtrlResponseLength);
+
+				/* Requester will clear this flag */
+				target->CtrlResponseProcessing = true;
 				UNLOCK_HTC_RX(target);
 
 				cdf_semaphore_release(target->osdev,