From 3f97e3dca7d97c3d4c83acbd5f839bdbb6909068 Mon Sep 17 00:00:00 2001 From: "Poddar, Siddarth" Date: Mon, 18 Dec 2017 15:11:13 +0530 Subject: [PATCH] qcacld-3.0: Check for peer delete in progress before assigning to temp var With the existing implementation of TAILQ_FOREACH_REVERSE in ol_txrx_remove_peers_for_vdev() function, host traverses the list, stores the peer in the var, releases the lock and later temp var is getting deleted as part of peer unmap and host end up in accessing the stale peer entry. To avoid this, host should check the peer delete in progress first before assigning it to the temp var. Change-Id: I5b9a401ae062efc6d2fbe608b25424a27c9d9f94 CRs-Fixed: 2159446 --- core/dp/txrx/ol_txrx.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/core/dp/txrx/ol_txrx.c b/core/dp/txrx/ol_txrx.c index bc595dadaf0b..187fb49ae16e 100644 --- a/core/dp/txrx/ol_txrx.c +++ b/core/dp/txrx/ol_txrx.c @@ -2964,12 +2964,12 @@ ol_txrx_remove_peers_for_vdev(struct cdp_vdev *pvdev, temp = NULL; TAILQ_FOREACH_REVERSE(peer, &vdev->peer_list, peer_list_t, peer_list_elem) { + if (qdf_atomic_read(&peer->delete_in_progress)) + continue; if (temp) { qdf_spin_unlock_bh(&vdev->pdev->peer_ref_mutex); - if (qdf_atomic_read(&temp->delete_in_progress) == 0) { - callback(callback_context, temp->mac_addr.raw, - vdev->vdev_id, temp, false); - } + callback(callback_context, temp->mac_addr.raw, + vdev->vdev_id, temp, false); qdf_spin_lock_bh(&vdev->pdev->peer_ref_mutex); } /* self peer is deleted last */