From 427357d954fe876f95f72b124f3d483c6fe55235 Mon Sep 17 00:00:00 2001
From: Dustin Brown <dustinb@codeaurora.org>
Date: Tue, 31 Jul 2018 16:33:43 -0700
Subject: [PATCH] qcacmn: Acquire nbuf meta lock during free

qdf_nbuf_free_debug() does a hashtable lookup for nbuf metadata without
grabbing the appropriate spinlock. This naturally leads to a variety of
issues. Acquire the nbuf metadata lock while accessing the metadata
hashtable in qdf_nbuf_free_debug().

Change-Id: I058b00abcf0162c764fc9ad5011be341a07f2b9d
CRs-Fixed: 2288522
---
 qdf/linux/src/qdf_nbuf.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/qdf/linux/src/qdf_nbuf.c b/qdf/linux/src/qdf_nbuf.c
index 9bdc61a1b7d6..893b3dfc2593 100644
--- a/qdf/linux/src/qdf_nbuf.c
+++ b/qdf/linux/src/qdf_nbuf.c
@@ -2640,11 +2640,13 @@ void qdf_nbuf_free_debug(qdf_nbuf_t nbuf, uint8_t *file, uint32_t line)
 	if (qdf_likely(nbuf)) {
 		struct qdf_nbuf_map_metadata *meta;
 
+		qdf_spin_lock_irqsave(&qdf_nbuf_map_lock);
 		meta = qdf_nbuf_meta_get(nbuf);
 		if (meta)
 			QDF_DEBUG_PANIC(
 				"Nbuf freed @ %s:%u while mapped from %s:%u",
 				kbasename(file), line, meta->file, meta->line);
+		qdf_spin_unlock_irqrestore(&qdf_nbuf_map_lock);
 
 		qdf_net_buf_debug_delete_node(nbuf);
 		qdf_nbuf_history_add(nbuf, file, line, QDF_NBUF_FREE);