瀏覽代碼

qcacld-3.0: Fix use after free during RX thread enqueue

Currently nbuf is being used to get gso segments after enqueue
to DP RX thread, this will lead to use after free issue because
RX thread may process and even free the buffer by the time nbuf
is accessed for getting gso segments in enqueue/softirq context.

Fix this by updating gso segments before nbuf enqueue to DP RX thread.

Change-Id: I2cc93bf9a44e2d487c1a6d474349cf5c0c5db76a
CRs-Fixed: 2958132
Karthik Kantamneni 3 年之前
父節點
當前提交
ac8b9aa535
共有 1 個文件被更改,包括 2 次插入2 次删除
  1. 2 2
      core/dp/txrx3.0/dp_rx_thread.c

+ 2 - 2
core/dp/txrx3.0/dp_rx_thread.c

@@ -276,10 +276,10 @@ static QDF_STATUS dp_rx_tm_thread_enqueue(struct dp_rx_thread *rx_thread,
 		num_elements_in_nbuf--;
 		next_ptr_list = head_ptr->next;
 		qdf_nbuf_set_next(head_ptr, NULL);
-		qdf_nbuf_queue_head_enqueue_tail(&rx_thread->nbuf_queue,
-						 head_ptr);
 		/* count aggregated RX frame into enqueued stats */
 		nbuf_queued += qdf_nbuf_get_gso_segs(head_ptr);
+		qdf_nbuf_queue_head_enqueue_tail(&rx_thread->nbuf_queue,
+						 head_ptr);
 		head_ptr = next_ptr_list;
 	}