A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 08:07:32 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Lock the packet lists before freeing

Browse source 
1) The htt htc free packet list is accessed without being protected
by a lock when packets are being removed from it, which may
introduce a potential racing condition during stability stress
test. Protect the list by htt tx mutex before any pakcets are freed
from it.

2) The same protection should be done to the htt htc packet misc
list.

Change-Id: Ife075a24f119ccfff9b56ec6ce3bee5dd73c9dea
CRs-Fixed: 2137038
This commit is contained in:
wadesong 2017-10-28 07:15:51 +08:00 • committed by snandini
commit 43468c4626
1 changed files with 8 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

10
core/dp/htt/htt.c
View file

@ -109,13 +109,16 @@ void htt_htc_pkt_pool_free(struct htt_pdev_t *pdev)
{
struct htt_htc_pkt_union *pkt, *next;
HTT_TX_MUTEX_ACQUIRE(&pdev->htt_tx_mutex);
pkt = pdev->htt_htc_pkt_freelist;
pdev->htt_htc_pkt_freelist = NULL;
HTT_TX_MUTEX_RELEASE(&pdev->htt_tx_mutex);
while (pkt) {
next = pkt->u.next;
qdf_mem_free(pkt);
pkt = next;
}
pdev->htt_htc_pkt_freelist = NULL;
}
#ifdef ATH_11AC_TXCOMPACT
@ -175,12 +178,16 @@ void htt_htc_misc_pkt_pool_free(struct htt_pdev_t *pdev)
struct htt_htc_pkt_union *pkt, *next;
qdf_nbuf_t netbuf;
HTT_TX_MUTEX_ACQUIRE(&pdev->htt_tx_mutex);
pkt = pdev->htt_htc_pkt_misclist;
pdev->htt_htc_pkt_misclist = NULL;
HTT_TX_MUTEX_RELEASE(&pdev->htt_tx_mutex);
while (pkt) {
next = pkt->u.next;
if (htc_packet_get_magic_cookie(&(pkt->u.pkt.htc_pkt)) !=
HTC_PACKET_MAGIC_COOKIE) {
QDF_ASSERT(0);
pkt = next;
continue;
}
@ -191,7 +198,6 @@ void htt_htc_misc_pkt_pool_free(struct htt_pdev_t *pdev)
qdf_mem_free(pkt);
pkt = next;
}
pdev->htt_htc_pkt_misclist = NULL;
}
#endif