A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 05:39:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Dequeue nbuf list from rx thread before continue

Browse source 
Currently in function dp_rx_thread_process_nbufq inside while
loop with nbuf list as condition if peer or vdev is not found
nbuf list is freed but not assigned to NULL and continue operation
is done. This leads to invalid freed nbuf list access in successive
loop iteration. In this change after nbuf list is freed assign it
to the next nbuf list which is in the rx thread queue.

Change-Id: I4b595a8708f91677645815105ad736926de91758
CRs-Fixed: 2309908
This commit is contained in:
Sravan Kumar Kairam 2018-09-12 15:27:45 +05:30 • committed by nshrivas
commit 0512a84dba
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
core/dp/txrx3.0/dp_rx_thread.c
View file

@ -260,7 +260,7 @@ static int dp_rx_thread_process_nbufq(struct dp_rx_thread *rx_thread)
dp_err("peer not found for local_id %u!",
peer_local_id);
qdf_nbuf_list_free(nbuf_list);
continue;
goto dequeue_rx_thread;
}
vdev = cdp_peer_get_vdev(soc, peer);
@ -270,7 +270,7 @@ static int dp_rx_thread_process_nbufq(struct dp_rx_thread *rx_thread)
dp_err("vdev not found for local_id %u!, pkt dropped",
peer_local_id);
qdf_nbuf_list_free(nbuf_list);
continue;
goto dequeue_rx_thread;
}
cdp_get_os_rx_handles_from_vdev(soc, vdev, &stack_fn,
@ -281,10 +281,12 @@ static int dp_rx_thread_process_nbufq(struct dp_rx_thread *rx_thread)
rx_thread->stats.dropped_others +=
num_list_elements;
qdf_nbuf_list_free(nbuf_list);
goto dequeue_rx_thread;
}
stack_fn(osif_vdev, nbuf_list);
rx_thread->stats.nbuf_sent_to_stack += num_list_elements;
dequeue_rx_thread:
nbuf_list = dp_rx_tm_thread_dequeue(rx_thread);
}