Explorar o código

qcacld-3.0: Fix use after free during RX thread enqueue

Currently nbuf is being used to get gso segments after enqueue
to DP RX thread, this will lead to use after free issue because
RX thread may process and even free the buffer by the time nbuf
is accessed for getting gso segments in enqueue/softirq context.

Fix this by updating gso segments before nbuf enqueue to DP RX thread.

Change-Id: I2cc93bf9a44e2d487c1a6d474349cf5c0c5db76a
CRs-Fixed: 2958132
Karthik Kantamneni %!s(int64=3) %!d(string=hai) anos
pai
achega
ac8b9aa535
Modificáronse 1 ficheiros con 2 adicións e 2 borrados
  1. 2 2
      core/dp/txrx3.0/dp_rx_thread.c

+ 2 - 2
core/dp/txrx3.0/dp_rx_thread.c

@@ -276,10 +276,10 @@ static QDF_STATUS dp_rx_tm_thread_enqueue(struct dp_rx_thread *rx_thread,
 		num_elements_in_nbuf--;
 		next_ptr_list = head_ptr->next;
 		qdf_nbuf_set_next(head_ptr, NULL);
-		qdf_nbuf_queue_head_enqueue_tail(&rx_thread->nbuf_queue,
-						 head_ptr);
 		/* count aggregated RX frame into enqueued stats */
 		nbuf_queued += qdf_nbuf_get_gso_segs(head_ptr);
+		qdf_nbuf_queue_head_enqueue_tail(&rx_thread->nbuf_queue,
+						 head_ptr);
 		head_ptr = next_ptr_list;
 	}