Browse Source

qcacmn: Peer ref count leaks in ppdu stats and descriptor deliver

Because of reference counter decrement is not triggered for every
condition path, it is possible that peer reference counter leaking
happens under some perticular circumstance. Make sure the peer ref
count unreference is called for each possible path.

CRs-Fixed: 2352433
Change-Id: I60bc5a5210519c26c57cdc563d0d1b02d799e090
chenguo 6 years ago
parent
commit
b21a49a57e
2 changed files with 9 additions and 10 deletions
  1. 1 2
      dp/wifi3.0/dp_htt.c
  2. 8 8
      dp/wifi3.0/dp_rx_mon_status.c

+ 1 - 2
dp/wifi3.0/dp_htt.c

@@ -2480,11 +2480,10 @@ void dp_ppdu_desc_deliver(struct dp_pdev *pdev,
 			dp_tx_stats_update(pdev->soc, peer,
 					&ppdu_desc->user[i],
 					ppdu_desc->ack_rssi);
-
-			dp_peer_unref_del_find_by_id(peer);
 		}
 
 		dp_tx_rate_stats_update(peer, &ppdu_desc->user[i]);
+		dp_peer_unref_del_find_by_id(peer);
 	}
 
 	/*

+ 8 - 8
dp/wifi3.0/dp_rx_mon_status.c

@@ -416,16 +416,16 @@ dp_rx_handle_ppdu_stats(struct dp_soc *soc, struct dp_pdev *pdev,
 				sizeof(struct cdp_rx_indication_ppdu));
 		cdp_rx_ppdu = (struct cdp_rx_indication_ppdu *)ppdu_nbuf->data;
 		peer = dp_peer_find_by_id(soc, cdp_rx_ppdu->peer_id);
+		if (peer) {
+			dp_rx_stats_update(pdev, peer, cdp_rx_ppdu);
+			dp_peer_unref_del_find_by_id(peer);
+		}
 		if (cdp_rx_ppdu->peer_id != HTT_INVALID_PEER) {
-			if (peer) {
-				dp_rx_stats_update(pdev, peer, cdp_rx_ppdu);
-				dp_wdi_event_handler(WDI_EVENT_RX_PPDU_DESC,
-					soc, ppdu_nbuf, cdp_rx_ppdu->peer_id,
-					WDI_NO_VAL, pdev->pdev_id);
-				dp_peer_unref_del_find_by_id(peer);
-			}
+			dp_wdi_event_handler(WDI_EVENT_RX_PPDU_DESC,
+					     soc, ppdu_nbuf,
+					     cdp_rx_ppdu->peer_id,
+					     WDI_NO_VAL, pdev->pdev_id);
 		} else if (pdev->mcopy_mode) {
-			dp_rx_stats_update(pdev, peer, cdp_rx_ppdu);
 			dp_wdi_event_handler(WDI_EVENT_RX_PPDU_DESC, soc,
 					ppdu_nbuf, HTT_INVALID_PEER,
 					WDI_NO_VAL, pdev->pdev_id);