From 0512a84dbad3dc225d92a5cdbe8d495a6c6103af Mon Sep 17 00:00:00 2001 From: Sravan Kumar Kairam Date: Wed, 12 Sep 2018 15:27:45 +0530 Subject: [PATCH] qcacld-3.0: Dequeue nbuf list from rx thread before continue Currently in function dp_rx_thread_process_nbufq inside while loop with nbuf list as condition if peer or vdev is not found nbuf list is freed but not assigned to NULL and continue operation is done. This leads to invalid freed nbuf list access in successive loop iteration. In this change after nbuf list is freed assign it to the next nbuf list which is in the rx thread queue. Change-Id: I4b595a8708f91677645815105ad736926de91758 CRs-Fixed: 2309908 --- core/dp/txrx3.0/dp_rx_thread.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/core/dp/txrx3.0/dp_rx_thread.c b/core/dp/txrx3.0/dp_rx_thread.c index 0f7f5702d84e..4d701dc43856 100644 --- a/core/dp/txrx3.0/dp_rx_thread.c +++ b/core/dp/txrx3.0/dp_rx_thread.c @@ -260,7 +260,7 @@ static int dp_rx_thread_process_nbufq(struct dp_rx_thread *rx_thread) dp_err("peer not found for local_id %u!", peer_local_id); qdf_nbuf_list_free(nbuf_list); - continue; + goto dequeue_rx_thread; } vdev = cdp_peer_get_vdev(soc, peer); @@ -270,7 +270,7 @@ static int dp_rx_thread_process_nbufq(struct dp_rx_thread *rx_thread) dp_err("vdev not found for local_id %u!, pkt dropped", peer_local_id); qdf_nbuf_list_free(nbuf_list); - continue; + goto dequeue_rx_thread; } cdp_get_os_rx_handles_from_vdev(soc, vdev, &stack_fn, @@ -281,10 +281,12 @@ static int dp_rx_thread_process_nbufq(struct dp_rx_thread *rx_thread) rx_thread->stats.dropped_others += num_list_elements; qdf_nbuf_list_free(nbuf_list); + goto dequeue_rx_thread; } stack_fn(osif_vdev, nbuf_list); rx_thread->stats.nbuf_sent_to_stack += num_list_elements; +dequeue_rx_thread: nbuf_list = dp_rx_tm_thread_dequeue(rx_thread); }