qcacmn: Clear defrag waitlist in all cases
Rx defrag waitlist was not getting cleared during dp_peer_rx_cleanup in the case of STA mode even though the tid was getting deleted. This created a scenario where the next time dp_rx_defrag_waitlist_remove was called, it was trying to access now invalid memory. If a vdev was disconnected in the middle of receiving traffic, then the tid would be deleted but the rx frag waitlist would not. Upon reconnecting, the reception of the next frag would cause a crash due to the now invalid memory in the waitlist. Change-Id: I5bb1a31f38fa45128d0f35fafaddaf729c99489d CRs-Fixed: 2538879
このコミットが含まれているのは:
@@ -2298,12 +2298,12 @@ void dp_peer_rx_cleanup(struct dp_vdev *vdev, struct dp_peer *peer, bool reuse)
|
||||
int tid;
|
||||
uint32_t tid_delete_mask = 0;
|
||||
|
||||
DP_TRACE(INFO_HIGH, FL("Remove tids for peer: %pK"), peer);
|
||||
dp_info("Remove tids for peer: %pK", peer);
|
||||
for (tid = 0; tid < DP_MAX_TIDS; tid++) {
|
||||
struct dp_rx_tid *rx_tid = &peer->rx_tid[tid];
|
||||
|
||||
qdf_spin_lock_bh(&rx_tid->tid_lock);
|
||||
if (!peer->bss_peer && peer->vdev->opmode != wlan_op_mode_sta) {
|
||||
if (!peer->bss_peer || peer->vdev->opmode == wlan_op_mode_sta) {
|
||||
/* Cleanup defrag related resource */
|
||||
dp_rx_defrag_waitlist_remove(peer, tid);
|
||||
dp_rx_reorder_flush_frag(peer, tid);
|
||||
|
新しいイシューから参照
ユーザーをブロックする