A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: keep objmgr_peer alive until txrx peer is freed

Browse source 
Make sure the objmgr_peer is not deleted before
dp peer is deleted, which will avoid the access
of already freed objmgr_peer for connected sta peers.

Change-Id: Ib931dcd0c5650fea5284e9dd53dae9e41f662c56
CRs-Fixed: 2359645
This commit is contained in:
Pavankumar Nandeshwar 2018-12-20 18:57:12 +05:30 • committed by nshrivas
commit 2702aeeb0a
3 changed files with 18 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

3
dp/inc/cdp_txrx_ops.h
View file

@ -852,7 +852,8 @@ struct ol_if_ops {
uint8_t vdev_id, uint8_t *peer_macaddr,
uint32_t tid_mask);
int (*peer_unref_delete)(void *scn_handle, uint8_t *peer_mac,
uint8_t *vdev_mac, enum wlan_op_mode opmode);
uint8_t *vdev_mac, enum wlan_op_mode opmode,
void *old_peer, void *new_peer);
bool (*is_hw_dbs_2x2_capable)(struct wlan_objmgr_psoc *psoc);
int (*peer_add_wds_entry)(void *vdev_handle,
struct cdp_peer *peer_handle,

15
dp/wifi3.0/dp_main.c
View file

@ -4648,7 +4648,7 @@ static void *dp_peer_create_wifi3(struct cdp_vdev *vdev_handle,
if (soc->cdp_soc.ol_ops->peer_unref_delete) {
soc->cdp_soc.ol_ops->peer_unref_delete(pdev->ctrl_pdev,
peer->mac_addr.raw, vdev->mac_addr.raw,
vdev->opmode);
vdev->opmode, peer->ctrl_peer, ctrl_peer);
}
peer->ctrl_peer = ctrl_peer;
@ -5146,7 +5146,8 @@ static void dp_reset_and_release_peer_mem(struct dp_soc *soc,
m_addr = peer->mac_addr.raw;
if (soc->cdp_soc.ol_ops->peer_unref_delete)
soc->cdp_soc.ol_ops->peer_unref_delete(pdev->ctrl_pdev,
m_addr, vdev->mac_addr.raw, vdev->opmode);
m_addr, vdev->mac_addr.raw, vdev->opmode,
peer->ctrl_peer, NULL);
if (vdev && vdev->vap_bss_peer) {
bss_peer = vdev->vap_bss_peer;
@ -5320,7 +5321,15 @@ static void dp_peer_delete_wifi3(void *peer_handle, uint32_t bitmap)
*/
peer->rx_opt_proc = dp_rx_discard;
peer->ctrl_peer = NULL;
/* Do not make ctrl_peer to NULL for connected sta peers.
* We need ctrl_peer to release the reference during dp
* peer free. This reference was held for
* obj_mgr peer during the creation of dp peer.
*/
if (!(peer->vdev && (peer->vdev->opmode != wlan_op_mode_sta) &&
!peer->bss_peer))
peer->ctrl_peer = NULL;
QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_INFO_HIGH,
FL("peer %pK (%pM)"), peer, peer->mac_addr.raw);

5
umac/cmn_services/obj_mgr/inc/wlan_objmgr_cmn.h
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2016-2018 The Linux Foundation. All rights reserved.
* Copyright (c) 2016-2019 The Linux Foundation. All rights reserved.
*
* Permission to use, copy, modify, and/or distribute this software for
* any purpose with or without fee is hereby granted, provided that the
@ -229,6 +229,7 @@ typedef void (*wlan_objmgr_peer_status_handler)(
* @WLAN_MLME_OBJ_DEL_ID: Object delete req/resp tracking with FW
* @WLAN_ACTION_OUI_ID: action oui operations
* @WLAN_LEGACY_SAP_ID: legacy sap fsm
* @WLAN_TGT_IF_DP_PEER_REF_ID: cp peer reference in dp (Target IF)
* @WLAN_REF_ID_MAX: Max id used to generate ref count tracking array
*/
/* New value added to the enum must also be reflected in function
@ -280,6 +281,7 @@ typedef enum {
WLAN_MLME_OBJ_DEL_ID = 42,
WLAN_ACTION_OUI_ID = 43,
WLAN_LEGACY_SAP_ID = 44,
WLAN_TGT_IF_DP_PEER_REF_ID = 45,
WLAN_REF_ID_MAX,
} wlan_objmgr_ref_dbgid;
@ -338,6 +340,7 @@ static inline char *string_from_dbgid(wlan_objmgr_ref_dbgid id)
"WLAN_MLME_OBJ_DEL_ID",
"WLAN_ACTION_OUI_ID",
"WLAN_LEGACY_SAP_ID",
"WLAN_TGT_IF_DP_PEER_REF_ID",
"WLAN_REF_ID_MAX"};
return (char *)strings[id];