From 5fb3096c626ed362efe8c9663ffee15db98e1111 Mon Sep 17 00:00:00 2001 From: Wu Gao Date: Thu, 16 Aug 2018 13:25:29 +0800 Subject: [PATCH] qcacmn: Get next node and then delete current queue It will delete current node and then get next node by current node, which cause NULL pointer access. Change-Id: Ieb1f1fe924d4c86368e340b2482f2ffdb09f301f CRs-Fixed: 2297087 --- core/src/wlan_p2p_off_chan_tx.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/core/src/wlan_p2p_off_chan_tx.c b/core/src/wlan_p2p_off_chan_tx.c index a03fe0127983..849dafced0c8 100644 --- a/core/src/wlan_p2p_off_chan_tx.c +++ b/core/src/wlan_p2p_off_chan_tx.c @@ -1721,6 +1721,8 @@ QDF_STATUS p2p_process_cleanup_tx_queue(struct p2p_cleanup_param *param) while (QDF_IS_STATUS_SUCCESS(status)) { curr_tx_ctx = qdf_container_of(p_node, struct tx_action_context, node); + status = qdf_list_peek_next(&p2p_soc_obj->tx_q_roc, + p_node, &p_node); if ((vdev_id == P2P_INVALID_VDEV_ID) || (vdev_id == curr_tx_ctx->vdev_id)) { ret = qdf_list_remove_node(&p2p_soc_obj->tx_q_roc, @@ -1733,8 +1735,6 @@ QDF_STATUS p2p_process_cleanup_tx_queue(struct p2p_cleanup_param *param) p2p_err("remove %pK from roc_q fail", curr_tx_ctx); } - status = qdf_list_peek_next(&p2p_soc_obj->tx_q_roc, - p_node, &p_node); } p2p_debug("clean up tx queue wait for ack, size:%d", @@ -1744,6 +1744,8 @@ QDF_STATUS p2p_process_cleanup_tx_queue(struct p2p_cleanup_param *param) while (QDF_IS_STATUS_SUCCESS(status)) { curr_tx_ctx = qdf_container_of(p_node, struct tx_action_context, node); + status = qdf_list_peek_next(&p2p_soc_obj->tx_q_ack, + p_node, &p_node); if ((vdev_id == P2P_INVALID_VDEV_ID) || (vdev_id == curr_tx_ctx->vdev_id)) { ret = qdf_list_remove_node(&p2p_soc_obj->tx_q_ack, @@ -1757,8 +1759,6 @@ QDF_STATUS p2p_process_cleanup_tx_queue(struct p2p_cleanup_param *param) p2p_err("remove %pK from roc_q fail", curr_tx_ctx); } - status = qdf_list_peek_next(&p2p_soc_obj->tx_q_ack, - p_node, &p_node); } qdf_event_set(&p2p_soc_obj->cleanup_tx_done);