From 291dfa00430ed2f5b95ee615bc2f03a37d041bb6 Mon Sep 17 00:00:00 2001 From: Chaithanya Garrepalli Date: Fri, 12 Oct 2018 17:11:34 +0530 Subject: [PATCH] qcacmn: flushing reo command list before freeing pdev In dp_soc_dettach flush the reo command list before freeing pdev to avoid use after free of pdev memory in reo command callbacks Change-Id: I2644b259ed9b10dee9b11007ed9064dd7d2399a9 --- dp/wifi3.0/dp_main.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/dp/wifi3.0/dp_main.c b/dp/wifi3.0/dp_main.c index ef6074b8ab95..92eea6884e0c 100644 --- a/dp/wifi3.0/dp_main.c +++ b/dp/wifi3.0/dp_main.c @@ -3261,6 +3261,8 @@ static void dp_soc_detach_wifi3(void *txrx_soc) /* Free pending htt stats messages */ qdf_nbuf_queue_free(&soc->htt_stats.msg); + dp_reo_cmdlist_destroy(soc); + for (i = 0; i < MAX_PDEV_CNT; i++) { if (soc->pdev_list[i]) dp_pdev_detach_wifi3( @@ -3328,7 +3330,6 @@ static void dp_soc_detach_wifi3(void *txrx_soc) qdf_spinlock_destroy(&soc->rx.defrag.defrag_lock); - dp_reo_cmdlist_destroy(soc); qdf_spinlock_destroy(&soc->rx.reo_cmd_lock); dp_reo_desc_freelist_destroy(soc); @@ -5238,6 +5239,9 @@ void dp_rx_bar_stats_cb(struct dp_soc *soc, void *cb_ctxt, struct dp_pdev *pdev = (struct dp_pdev *)cb_ctxt; struct hal_reo_queue_status *queue_status = &(reo_status->queue_status); + if (!qdf_atomic_read(&soc->cmn_init_done)) + return; + if (queue_status->header.status != HAL_REO_CMD_SUCCESS) { DP_TRACE_STATS(FATAL, "REO stats failure %d \n", queue_status->header.status);