From 3eff34087b3b2ddabfb4af1790960ac03a02c22e Mon Sep 17 00:00:00 2001 From: Ananya Gupta Date: Wed, 1 Dec 2021 12:30:12 +0530 Subject: [PATCH] qcacld-3.0: Drop packets when vdev_id is invalid There is a race condition when adapter is deleted after it is validated in DP rx path and is assigned an invalid vdev id and eventually invalid net_device. To fix this, dropping packets if vdev id is found to be invalid right before assignment to skb->cb. Change-Id: I4e483363f59a22b45e18da929f749cd9807cc2fc CRs-Fixed: 3084556 --- core/hdd/src/wlan_hdd_tx_rx.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/core/hdd/src/wlan_hdd_tx_rx.c b/core/hdd/src/wlan_hdd_tx_rx.c index 645b40897d31..b59c6ecacc34 100644 --- a/core/hdd/src/wlan_hdd_tx_rx.c +++ b/core/hdd/src/wlan_hdd_tx_rx.c @@ -2150,6 +2150,13 @@ QDF_STATUS hdd_rx_pkt_thread_enqueue_cbk(void *adapter, return hdd_adapter->rx_stack(adapter, nbuf_list); vdev_id = hdd_adapter->vdev_id; + + if (vdev_id >= WLAN_UMAC_VDEV_ID_MAX) { + hdd_info_rl("Vdev invalid. Dropping packets"); + qdf_nbuf_list_free(nbuf_list); + return QDF_STATUS_E_NETDOWN; + } + head_ptr = nbuf_list; while (head_ptr) { qdf_nbuf_cb_update_vdev_id(head_ptr, vdev_id);