A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 15:49:17 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix use-after-free for peer->access_list

Browse source 
In ol_txrx_peer_release_ref, it is possible that this function is
scheduled out when just unlock peer_ref_mutex, unmap event will
come to decrease ref_cnt and free peer object, when
ol_txrx_peer_release_ref is scheduled back and access peer info,
it will cause use-after-free.

Get peer info in the protection of peer_ref_mutex.

Change-Id: Ic442f53e0993a931c4411d9dbc85f04d6a85dc46
CRs-Fixed: 2180584
This commit is contained in:
Jingxiang Ge 2018-01-30 08:56:19 +08:00 • committed by snandini
commit 190679b412
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
core/dp/txrx/ol_txrx.c
View file

@ -3415,6 +3415,7 @@ int ol_txrx_peer_release_ref(ol_txrx_peer_handle peer,
struct ol_txrx_vdev_t *vdev;
struct ol_txrx_pdev_t *pdev;
bool ref_silent = false;
int access_list = 0;
/* preconditions */
TXRX_ASSERT2(peer);
@ -3598,12 +3599,13 @@ int ol_txrx_peer_release_ref(ol_txrx_peer_handle peer,
qdf_mem_free(peer);
} else {
access_list = qdf_atomic_read(
&peer->access_list[debug_id]);
qdf_spin_unlock_bh(&pdev->peer_ref_mutex);
if (!ref_silent)
ol_txrx_info_high("[%d][%d]: ref delete peer %p ref_cnt -> %d",
debug_id,
qdf_atomic_read(
&peer->access_list[debug_id]),
access_list,
peer, rc);
}
return rc;