A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 16:46:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: flushing reo command list before freeing pdev

Browse source 
In dp_soc_dettach flush the reo command list before freeing
pdev to avoid use after free of pdev memory in reo command
callbacks

Change-Id: I2644b259ed9b10dee9b11007ed9064dd7d2399a9
This commit is contained in:
Chaithanya Garrepalli 2018-10-12 17:11:34 +05:30 • committed by nshrivas
commit 291dfa0043
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
dp/wifi3.0/dp_main.c
View file

@ -3261,6 +3261,8 @@ static void dp_soc_detach_wifi3(void *txrx_soc)
/* Free pending htt stats messages */
qdf_nbuf_queue_free(&soc->htt_stats.msg);
dp_reo_cmdlist_destroy(soc);
for (i = 0; i < MAX_PDEV_CNT; i++) {
if (soc->pdev_list[i])
dp_pdev_detach_wifi3(
@ -3328,7 +3330,6 @@ static void dp_soc_detach_wifi3(void *txrx_soc)
qdf_spinlock_destroy(&soc->rx.defrag.defrag_lock);
dp_reo_cmdlist_destroy(soc);
qdf_spinlock_destroy(&soc->rx.reo_cmd_lock);
dp_reo_desc_freelist_destroy(soc);
@ -5238,6 +5239,9 @@ void dp_rx_bar_stats_cb(struct dp_soc *soc, void *cb_ctxt,
struct dp_pdev *pdev = (struct dp_pdev *)cb_ctxt;
struct hal_reo_queue_status *queue_status = &(reo_status->queue_status);
if (!qdf_atomic_read(&soc->cmn_init_done))
return;
if (queue_status->header.status != HAL_REO_CMD_SUCCESS) {
DP_TRACE_STATS(FATAL, "REO stats failure %d \n",
queue_status->header.status);