A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-24 21:54:34 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: set mpdu next to null during msdu stitching

Browse source 
In monitor mode, when we try to stitch msdus together into an ampdu
to be sent to the stack (dp_rx_mon_restitch_mpdu_from_msdus),
we aggregate them together via frag_list. In the current code,
for the first msdu in which the frag_list is populated (if there are
more than one msdus to be sent to stack), the next pointer (skb->next)
is not set to NULL. This causes the HDD code to process the next
pointer leading to issues double free issues.

Set the next pointer for the first msdu(with frag_list) to NULL.

Change-Id: I60d1d463c7bbb602e4b199fbb691340ad6247bc5
CRs-Fixed: 2173405
This commit is contained in:
Mohit Khanna 2018-01-16 16:04:05 -08:00 • committed by snandini
commit 33ed0312fa
1 changed files with 1 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
dp/wifi3.0/dp_rx_mon_dest.c
View file

@ -416,6 +416,7 @@ qdf_nbuf_t dp_rx_mon_restitch_mpdu_from_msdus(struct dp_soc *soc,
frag_list_sum_len -= HAL_RX_FCS_LEN;
qdf_nbuf_append_ext_list(mpdu_buf, head_frag_list,
frag_list_sum_len);
qdf_nbuf_set_next(mpdu_buf, NULL);
}
goto mpdu_stitch_done;