Browse Source

qcacld-3.0: fix tx_desc vdev null pointer derefernce

In module exit context, vdev handle could be destroyed but still we
need to free pending completion tx_desc. And accessing vdev handle
of tx_desc will lead to null pointer derefernce.

Fix is to check vdev handle against null pointer.

Change-Id: Ib4e3127803f7bb0035466ec639401d7f8163598e
CRs-Fixed: 2074184
jiad 7 years ago
parent
commit
c6f5184601
1 changed files with 7 additions and 0 deletions
  1. 7 0
      core/dp/txrx/ol_tx_desc.c

+ 7 - 0
core/dp/txrx/ol_tx_desc.c

@@ -287,6 +287,13 @@ ol_tx_desc_alloc_hl(struct ol_txrx_pdev_t *pdev,
 static inline void
 ol_tx_desc_vdev_rm(struct ol_tx_desc_t *tx_desc)
 {
+	/*
+	 * In module exit context, vdev handle could be destroyed but still
+	 * we need to free pending completion tx_desc.
+	 */
+	if (!tx_desc || !tx_desc->vdev)
+		return;
+
 	qdf_atomic_dec(&tx_desc->vdev->tx_desc_count);
 	tx_desc->vdev = NULL;
 }