A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-23 21:19:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Avoid memory corruption when calling cb to release cmd memory

Browse source 
When serialization puts the command in active queue & activates
the command, it gives the callback to command owner as part of
the activation procedure. If this activation callback fails then
serialization suppose to give a callback to the owner to release
the memory.
There are some instances observed in legacy platforms where owner
releases the memory itself as part of activation callback failure
first and gets serialization callback as well to release the same
memory. These scenario creates "double free" or "memory
corruption" phenomena.
In order to avoid this scenario, add a sanity check to make sure
command still present in active queue and memory is not released
by command owner before calling callback to release the memory.

Change-Id: Ide341e3288aadd7d6e4441a5768118cd1439d38d
CRs-Fixed: 2161678
This commit is contained in:
Zhu Jianmin 2018-02-01 09:32:46 +08:00 • committed by snandini
commit 181ebf835c
1 changed files with 12 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

17
umac/cmn_services/serialization/src/wlan_serialization_enqueue.c
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2017 The Linux Foundation. All rights reserved.
* Copyright (c) 2017-2018 The Linux Foundation. All rights reserved.
*
* Permission to use, copy, modify, and/or distribute this software for
* any purpose with or without fee is hereby granted, provided that the
@ -141,17 +141,24 @@ void wlan_serialization_activate_cmd(
*/
qdf_status = cmd_list->cmd.cmd_cb(&cmd_list->cmd,
WLAN_SER_CB_ACTIVATE_CMD);
if (qdf_status != QDF_STATUS_SUCCESS) {
if (QDF_IS_STATUS_SUCCESS(qdf_status))
return;
if (wlan_serialization_is_cmd_present_in_active_queue(
psoc, &cmd_list->cmd)) {
wlan_serialization_find_and_stop_timer(psoc,
&cmd_list->cmd);
&cmd_list->cmd);
cmd_list->cmd.cmd_cb(&cmd_list->cmd,
WLAN_SER_CB_RELEASE_MEM_CMD);
wlan_serialization_put_back_to_global_list(
queue, ser_pdev_obj, cmd_list);
wlan_serialization_move_pending_to_active(
} else {
serialization_err("cmd type:%d, id: %d is removed from active list already",
cmd_list->cmd.cmd_type,
cmd_list->cmd.cmd_id);
}
wlan_serialization_move_pending_to_active(
cmd_list->cmd.cmd_type,
ser_pdev_obj);
}
}
enum wlan_serialization_status