Преглед на файлове

qcacld-3.0: Avoid NULL skb dereference during softap TX

Change "qcacld-3.0: Record data in DP Trace" introduced skb tracing
functionity to the driver.  In hdd_softap_hard_start_xmit() logic was
added to trace the skb contents, including logic to trace the skb
contents when an skb was dropped.  However some of the code paths to
this "drop_pkt" tracing have a NULL skb.  Therefore we must bypass the
dropped skb content tracing when the skb is NULL.

Change-Id: I485c92647355a0f7f420f40640b697a1d3eb5fb0
CRs-Fixed: 938254
Jeff Johnson преди 9 години
родител
ревизия
edeff23d4f
променени са 1 файла, в които са добавени 4 реда и са изтрити 3 реда
  1. 4 3
      core/hdd/src/wlan_hdd_softap_tx_rx.c

+ 4 - 3
core/hdd/src/wlan_hdd_softap_tx_rx.c

@@ -288,7 +288,7 @@ int hdd_softap_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 		/* Check if the buffer has enough header room */
 		skb = skb_unshare(skb, GFP_ATOMIC);
 		if (!skb)
-			goto drop_pkt;
+			goto drop_pkt_accounting;
 
 		if (skb_headroom(skb) < dev->hard_header_len) {
 			struct sk_buff *tmp;
@@ -296,7 +296,7 @@ int hdd_softap_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 			skb = skb_realloc_headroom(tmp, dev->hard_header_len);
 			dev_kfree_skb(tmp);
 			if (!skb)
-				goto drop_pkt;
+				goto drop_pkt_accounting;
 		}
 #if defined (IPA_OFFLOAD)
 	}
@@ -357,10 +357,11 @@ drop_pkt:
 		DPTRACE(cdf_dp_trace(skb, CDF_DP_TRACE_DROP_PACKET_RECORD,
 				(uint8_t *)&skb->data[CDF_DP_TRACE_RECORD_SIZE],
 				(cdf_nbuf_len(skb)-CDF_DP_TRACE_RECORD_SIZE)));
+	kfree_skb(skb);
 
+drop_pkt_accounting:
 	++pAdapter->stats.tx_dropped;
 	++pAdapter->hdd_stats.hddTxRxStats.txXmitDropped;
-	kfree_skb(skb);
 
 	return NETDEV_TX_OK;
 }