ソースを参照

qcacld-3.0: Fix vdev null pointer access in disconnect handler

Vdev is NULL before completion of hdd disconnect process

Use hdd_objmgr_get_vdev() to get vdev reference and then pass it
to ucfg_if_mgr_deliver_event(). After using, release the
reference.

Change-Id: I683851a2b7b4376440637edc70b7fdaf71acfbd0
CRs-Fixed: 2812480
Jyoti Kumari 4 年 前
コミット
fb46c5c273
1 ファイル変更21 行追加16 行削除
  1. 21 16
      core/hdd/src/wlan_hdd_assoc.c

+ 21 - 16
core/hdd/src/wlan_hdd_assoc.c

@@ -2067,24 +2067,18 @@ static QDF_STATUS hdd_dis_connect_handler(struct hdd_adapter *adapter,
 	 */
 	sta_ctx->hdd_reassoc_scenario = false;
 
-	/* Unblock anyone waiting for disconnect to complete */
-	complete(&adapter->disconnect_comp_var);
-
-	hdd_nud_reset_tracking(adapter);
-
-	hdd_set_disconnect_status(adapter, false);
-
-	hdd_reset_limit_off_chan(adapter);
-
-	hdd_print_bss_info(sta_ctx);
-
 	/*
-	 * Following code will be cleaned once the interface manager
-	 * module is enabled.
-	 */
+	* Following code will be cleaned once the interface manager
+	* module is enabled.
+	*/
 #ifdef WLAN_FEATURE_INTERFACE_MGR
-	ucfg_if_mgr_deliver_event(adapter->vdev,
-				  WLAN_IF_MGR_EV_DISCONNECT_COMPLETE, NULL);
+	vdev = hdd_objmgr_get_vdev(adapter);
+	if (vdev) {
+		ucfg_if_mgr_deliver_event(vdev,
+					  WLAN_IF_MGR_EV_DISCONNECT_COMPLETE,
+					  NULL);
+		hdd_objmgr_put_vdev(vdev);
+	}
 #else
 	if (policy_mgr_is_sta_active_connection_exists(hdd_ctx->psoc) &&
 	    QDF_STA_MODE == adapter->device_mode) {
@@ -2095,6 +2089,17 @@ static QDF_STATUS hdd_dis_connect_handler(struct hdd_adapter *adapter,
 	}
 #endif
 
+	/* Unblock anyone waiting for disconnect to complete */
+	complete(&adapter->disconnect_comp_var);
+
+	hdd_nud_reset_tracking(adapter);
+
+	hdd_set_disconnect_status(adapter, false);
+
+	hdd_reset_limit_off_chan(adapter);
+
+	hdd_print_bss_info(sta_ctx);
+
 	return status;
 }