From 0685ec210f9c449c7755dd9b92bdf5d4992837e0 Mon Sep 17 00:00:00 2001
From: Wu Gao <wugao@codeaurora.org>
Date: Tue, 13 Mar 2018 18:23:03 +0800
Subject: [PATCH] qcacmn: Set flag for deleting tx context

Duplicate for MGMT frame tx ack comes before scheduler process first
one, then it will use freed memory. Add flag to avoid this case.

Change-Id: Id50f692ced0ddd5b267d096818f3e7ff12bf07aa
CRs-Fixed: 2188110
---
 umac/p2p/core/src/wlan_p2p_off_chan_tx.h    | 2 ++
 umac/p2p/dispatcher/src/wlan_p2p_tgt_api.c  | 6 ++++++
 umac/p2p/dispatcher/src/wlan_p2p_ucfg_api.c | 1 +
 3 files changed, 9 insertions(+)

diff --git a/umac/p2p/core/src/wlan_p2p_off_chan_tx.h b/umac/p2p/core/src/wlan_p2p_off_chan_tx.h
index 41bdc806d527..713c3c35a811 100644
--- a/umac/p2p/core/src/wlan_p2p_off_chan_tx.h
+++ b/umac/p2p/core/src/wlan_p2p_off_chan_tx.h
@@ -154,6 +154,7 @@ struct p2p_frame_info {
  * @off_chan:       Is this off channel tx
  * @no_cck:         Required cck or not
  * @no_ack:         Required ack or not
+ * @is_deleting:    Received tx ack and waiting for deleting
  * @duration:       Duration for the RoC
  * @tx_timer:       RoC timer
  * @frame_info:     Frame type information
@@ -170,6 +171,7 @@ struct tx_action_context {
 	bool off_chan;
 	bool no_cck;
 	bool no_ack;
+	bool is_deleting;
 	uint32_t duration;
 	qdf_mc_timer_t tx_timer;
 	struct p2p_frame_info frame_info;
diff --git a/umac/p2p/dispatcher/src/wlan_p2p_tgt_api.c b/umac/p2p/dispatcher/src/wlan_p2p_tgt_api.c
index 1762cf2b7618..6c41bb27a2dd 100644
--- a/umac/p2p/dispatcher/src/wlan_p2p_tgt_api.c
+++ b/umac/p2p/dispatcher/src/wlan_p2p_tgt_api.c
@@ -145,6 +145,12 @@ QDF_STATUS tgt_p2p_mgmt_ota_comp_cb(void *context, qdf_nbuf_t buf,
 		return QDF_STATUS_E_FAULT;
 	}
 
+	if (tx_ctx->is_deleting) {
+		p2p_info("Received duplicate tx ack");
+		return QDF_STATUS_SUCCESS;
+	}
+	tx_ctx->is_deleting = true;
+
 	tx_conf_event = qdf_mem_malloc(sizeof(*tx_conf_event));
 	if (!tx_conf_event) {
 		p2p_err("Failed to allocate tx cnf event");
diff --git a/umac/p2p/dispatcher/src/wlan_p2p_ucfg_api.c b/umac/p2p/dispatcher/src/wlan_p2p_ucfg_api.c
index 8e2ea051aa72..af51792cf72b 100644
--- a/umac/p2p/dispatcher/src/wlan_p2p_ucfg_api.c
+++ b/umac/p2p/dispatcher/src/wlan_p2p_ucfg_api.c
@@ -264,6 +264,7 @@ QDF_STATUS ucfg_p2p_mgmt_tx(struct wlan_objmgr_psoc *soc,
 	tx_action->no_cck = mgmt_frm->no_cck;
 	tx_action->no_ack = mgmt_frm->dont_wait_for_ack;
 	tx_action->off_chan = mgmt_frm->off_chan;
+	tx_action->is_deleting = false;
 	tx_action->buf = qdf_mem_malloc(tx_action->buf_len);
 	if (!(tx_action->buf)) {
 		p2p_err("Failed to allocate buffer for action frame");