From 43468c4626bad53a7919b078b231c092be3f7b31 Mon Sep 17 00:00:00 2001 From: wadesong Date: Sat, 28 Oct 2017 07:15:51 +0800 Subject: [PATCH] qcacld-3.0: Lock the packet lists before freeing 1) The htt htc free packet list is accessed without being protected by a lock when packets are being removed from it, which may introduce a potential racing condition during stability stress test. Protect the list by htt tx mutex before any pakcets are freed from it. 2) The same protection should be done to the htt htc packet misc list. Change-Id: Ife075a24f119ccfff9b56ec6ce3bee5dd73c9dea CRs-Fixed: 2137038 --- core/dp/htt/htt.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/core/dp/htt/htt.c b/core/dp/htt/htt.c index 5839ac977923..307095f579a3 100644 --- a/core/dp/htt/htt.c +++ b/core/dp/htt/htt.c @@ -109,13 +109,16 @@ void htt_htc_pkt_pool_free(struct htt_pdev_t *pdev) { struct htt_htc_pkt_union *pkt, *next; + HTT_TX_MUTEX_ACQUIRE(&pdev->htt_tx_mutex); pkt = pdev->htt_htc_pkt_freelist; + pdev->htt_htc_pkt_freelist = NULL; + HTT_TX_MUTEX_RELEASE(&pdev->htt_tx_mutex); + while (pkt) { next = pkt->u.next; qdf_mem_free(pkt); pkt = next; } - pdev->htt_htc_pkt_freelist = NULL; } #ifdef ATH_11AC_TXCOMPACT @@ -175,12 +178,16 @@ void htt_htc_misc_pkt_pool_free(struct htt_pdev_t *pdev) struct htt_htc_pkt_union *pkt, *next; qdf_nbuf_t netbuf; + HTT_TX_MUTEX_ACQUIRE(&pdev->htt_tx_mutex); pkt = pdev->htt_htc_pkt_misclist; + pdev->htt_htc_pkt_misclist = NULL; + HTT_TX_MUTEX_RELEASE(&pdev->htt_tx_mutex); while (pkt) { next = pkt->u.next; if (htc_packet_get_magic_cookie(&(pkt->u.pkt.htc_pkt)) != HTC_PACKET_MAGIC_COOKIE) { + QDF_ASSERT(0); pkt = next; continue; } @@ -191,7 +198,6 @@ void htt_htc_misc_pkt_pool_free(struct htt_pdev_t *pdev) qdf_mem_free(pkt); pkt = next; } - pdev->htt_htc_pkt_misclist = NULL; } #endif