A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 15:11:48 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix passing invalid ipa iface

Browse source 
Currently in net dev cleanup of ipa host interface if the
ipa interface does not exist for that particular net dev,
last ipa iface reference is passed. This may lead to invalid
access. So fix by validating the iface context before clean
up of host ipa interface.

Change-Id: I753c922b5c82c676a318df87552051fdd74c983c
CRs-Fixed: 2632382
This commit is contained in:
Sravan Goud 2020-03-02 16:58:31 +05:30 • committed by nshrivas
commit 1945c9fc0b
1 changed files with 10 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

22
components/ipa/core/src/wlan_ipa_core.c
View file

@ -2045,12 +2045,12 @@ static QDF_STATUS __wlan_ipa_wlan_evt(qdf_netdev_t net_dev, uint8_t device_mode,
type == QDF_IPA_AP_DISCONNECT) {
for (i = 0; i < WLAN_IPA_MAX_IFACE; i++) {
iface_ctx = &ipa_ctx->iface_context[i];
if (iface_ctx->dev == net_dev)
if (iface_ctx->dev == net_dev) {
wlan_ipa_cleanup_iface(
iface_ctx);
break;
}
}
if (iface_ctx)
wlan_ipa_cleanup_iface(iface_ctx);
}
return QDF_STATUS_SUCCESS;
@ -2288,12 +2288,11 @@ static QDF_STATUS __wlan_ipa_wlan_evt(qdf_netdev_t net_dev, uint8_t device_mode,
for (i = 0; i < WLAN_IPA_MAX_IFACE; i++) {
iface_ctx = &ipa_ctx->iface_context[i];
if (iface_ctx->dev == net_dev)
if (iface_ctx->dev == net_dev) {
wlan_ipa_cleanup_iface(iface_ctx);
break;
}
}
if (i < WLAN_IPA_MAX_IFACE)
wlan_ipa_cleanup_iface(iface_ctx);
qdf_mutex_release(&ipa_ctx->event_lock);
break;
@ -3673,12 +3672,11 @@ void wlan_ipa_cleanup_dev_iface(struct wlan_ipa_priv *ipa_ctx,
for (i = 0; i < WLAN_IPA_MAX_IFACE; i++) {
iface_ctx = &ipa_ctx->iface_context[i];
if (iface_ctx->dev == net_dev)
if (iface_ctx->dev == net_dev) {
wlan_ipa_cleanup_iface(iface_ctx);
break;
}
}
if (iface_ctx)
wlan_ipa_cleanup_iface(iface_ctx);
}
void wlan_ipa_uc_ssr_cleanup(struct wlan_ipa_priv *ipa_ctx)