From 1945c9fc0b8712bb5eee5bccf14f387380b097f1 Mon Sep 17 00:00:00 2001 From: Sravan Goud Date: Mon, 2 Mar 2020 16:58:31 +0530 Subject: [PATCH] qcacld-3.0: Fix passing invalid ipa iface Currently in net dev cleanup of ipa host interface if the ipa interface does not exist for that particular net dev, last ipa iface reference is passed. This may lead to invalid access. So fix by validating the iface context before clean up of host ipa interface. Change-Id: I753c922b5c82c676a318df87552051fdd74c983c CRs-Fixed: 2632382 --- components/ipa/core/src/wlan_ipa_core.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/components/ipa/core/src/wlan_ipa_core.c b/components/ipa/core/src/wlan_ipa_core.c index 0a73a14ddd21..71f57238c30b 100644 --- a/components/ipa/core/src/wlan_ipa_core.c +++ b/components/ipa/core/src/wlan_ipa_core.c @@ -2045,12 +2045,12 @@ static QDF_STATUS __wlan_ipa_wlan_evt(qdf_netdev_t net_dev, uint8_t device_mode, type == QDF_IPA_AP_DISCONNECT) { for (i = 0; i < WLAN_IPA_MAX_IFACE; i++) { iface_ctx = &ipa_ctx->iface_context[i]; - - if (iface_ctx->dev == net_dev) + if (iface_ctx->dev == net_dev) { + wlan_ipa_cleanup_iface( + iface_ctx); break; + } } - if (iface_ctx) - wlan_ipa_cleanup_iface(iface_ctx); } return QDF_STATUS_SUCCESS; @@ -2288,12 +2288,11 @@ static QDF_STATUS __wlan_ipa_wlan_evt(qdf_netdev_t net_dev, uint8_t device_mode, for (i = 0; i < WLAN_IPA_MAX_IFACE; i++) { iface_ctx = &ipa_ctx->iface_context[i]; - - if (iface_ctx->dev == net_dev) + if (iface_ctx->dev == net_dev) { + wlan_ipa_cleanup_iface(iface_ctx); break; + } } - if (i < WLAN_IPA_MAX_IFACE) - wlan_ipa_cleanup_iface(iface_ctx); qdf_mutex_release(&ipa_ctx->event_lock); break; @@ -3673,12 +3672,11 @@ void wlan_ipa_cleanup_dev_iface(struct wlan_ipa_priv *ipa_ctx, for (i = 0; i < WLAN_IPA_MAX_IFACE; i++) { iface_ctx = &ipa_ctx->iface_context[i]; - if (iface_ctx->dev == net_dev) + if (iface_ctx->dev == net_dev) { + wlan_ipa_cleanup_iface(iface_ctx); break; + } } - - if (iface_ctx) - wlan_ipa_cleanup_iface(iface_ctx); } void wlan_ipa_uc_ssr_cleanup(struct wlan_ipa_priv *ipa_ctx)