From 2702aeeb0adb031a31bbd4ae68d6c88ee0b8e2e5 Mon Sep 17 00:00:00 2001 From: Pavankumar Nandeshwar Date: Thu, 20 Dec 2018 18:57:12 +0530 Subject: [PATCH] qcacmn: keep objmgr_peer alive until txrx peer is freed Make sure the objmgr_peer is not deleted before dp peer is deleted, which will avoid the access of already freed objmgr_peer for connected sta peers. Change-Id: Ib931dcd0c5650fea5284e9dd53dae9e41f662c56 CRs-Fixed: 2359645 --- dp/inc/cdp_txrx_ops.h | 3 ++- dp/wifi3.0/dp_main.c | 15 ++++++++++++--- umac/cmn_services/obj_mgr/inc/wlan_objmgr_cmn.h | 5 ++++- 3 files changed, 18 insertions(+), 5 deletions(-) diff --git a/dp/inc/cdp_txrx_ops.h b/dp/inc/cdp_txrx_ops.h index 2b5d9ee91400..71f1dfe1069b 100644 --- a/dp/inc/cdp_txrx_ops.h +++ b/dp/inc/cdp_txrx_ops.h @@ -852,7 +852,8 @@ struct ol_if_ops { uint8_t vdev_id, uint8_t *peer_macaddr, uint32_t tid_mask); int (*peer_unref_delete)(void *scn_handle, uint8_t *peer_mac, - uint8_t *vdev_mac, enum wlan_op_mode opmode); + uint8_t *vdev_mac, enum wlan_op_mode opmode, + void *old_peer, void *new_peer); bool (*is_hw_dbs_2x2_capable)(struct wlan_objmgr_psoc *psoc); int (*peer_add_wds_entry)(void *vdev_handle, struct cdp_peer *peer_handle, diff --git a/dp/wifi3.0/dp_main.c b/dp/wifi3.0/dp_main.c index bd325768e52b..861b3e29edb2 100644 --- a/dp/wifi3.0/dp_main.c +++ b/dp/wifi3.0/dp_main.c @@ -4648,7 +4648,7 @@ static void *dp_peer_create_wifi3(struct cdp_vdev *vdev_handle, if (soc->cdp_soc.ol_ops->peer_unref_delete) { soc->cdp_soc.ol_ops->peer_unref_delete(pdev->ctrl_pdev, peer->mac_addr.raw, vdev->mac_addr.raw, - vdev->opmode); + vdev->opmode, peer->ctrl_peer, ctrl_peer); } peer->ctrl_peer = ctrl_peer; @@ -5146,7 +5146,8 @@ static void dp_reset_and_release_peer_mem(struct dp_soc *soc, m_addr = peer->mac_addr.raw; if (soc->cdp_soc.ol_ops->peer_unref_delete) soc->cdp_soc.ol_ops->peer_unref_delete(pdev->ctrl_pdev, - m_addr, vdev->mac_addr.raw, vdev->opmode); + m_addr, vdev->mac_addr.raw, vdev->opmode, + peer->ctrl_peer, NULL); if (vdev && vdev->vap_bss_peer) { bss_peer = vdev->vap_bss_peer; @@ -5320,7 +5321,15 @@ static void dp_peer_delete_wifi3(void *peer_handle, uint32_t bitmap) */ peer->rx_opt_proc = dp_rx_discard; - peer->ctrl_peer = NULL; + + /* Do not make ctrl_peer to NULL for connected sta peers. + * We need ctrl_peer to release the reference during dp + * peer free. This reference was held for + * obj_mgr peer during the creation of dp peer. + */ + if (!(peer->vdev && (peer->vdev->opmode != wlan_op_mode_sta) && + !peer->bss_peer)) + peer->ctrl_peer = NULL; QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_INFO_HIGH, FL("peer %pK (%pM)"), peer, peer->mac_addr.raw); diff --git a/umac/cmn_services/obj_mgr/inc/wlan_objmgr_cmn.h b/umac/cmn_services/obj_mgr/inc/wlan_objmgr_cmn.h index 25797e6184ed..fbe943079af9 100644 --- a/umac/cmn_services/obj_mgr/inc/wlan_objmgr_cmn.h +++ b/umac/cmn_services/obj_mgr/inc/wlan_objmgr_cmn.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2016-2018 The Linux Foundation. All rights reserved. + * Copyright (c) 2016-2019 The Linux Foundation. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -229,6 +229,7 @@ typedef void (*wlan_objmgr_peer_status_handler)( * @WLAN_MLME_OBJ_DEL_ID: Object delete req/resp tracking with FW * @WLAN_ACTION_OUI_ID: action oui operations * @WLAN_LEGACY_SAP_ID: legacy sap fsm + * @WLAN_TGT_IF_DP_PEER_REF_ID: cp peer reference in dp (Target IF) * @WLAN_REF_ID_MAX: Max id used to generate ref count tracking array */ /* New value added to the enum must also be reflected in function @@ -280,6 +281,7 @@ typedef enum { WLAN_MLME_OBJ_DEL_ID = 42, WLAN_ACTION_OUI_ID = 43, WLAN_LEGACY_SAP_ID = 44, + WLAN_TGT_IF_DP_PEER_REF_ID = 45, WLAN_REF_ID_MAX, } wlan_objmgr_ref_dbgid; @@ -338,6 +340,7 @@ static inline char *string_from_dbgid(wlan_objmgr_ref_dbgid id) "WLAN_MLME_OBJ_DEL_ID", "WLAN_ACTION_OUI_ID", "WLAN_LEGACY_SAP_ID", + "WLAN_TGT_IF_DP_PEER_REF_ID", "WLAN_REF_ID_MAX"}; return (char *)strings[id];