A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-25 06:03:36 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Protect csr_scan_callback with sme lock

Browse source 
In csr_scan_callback sme lock is not taken and csr session
is accessed without taking the lock. This may lead to
race where a north bound thread and scheduler thread
might modify the same param at a time.

Thus if a new connect request is received at same time which
also lead to scan for ssid, scheduler and the NB thread
may try to free session->scan_info.profile at same time
leading to double free.

Fix is to protect csr_scan_callback with sme lock.

Change-Id: I44519f53f41b94a1ba6420efef2d35a98a7bcaf5
CRs-Fixed: 2547428
This commit is contained in:
Abhinav Kumar 2019-10-17 14:22:24 +05:30 • committed by nshrivas
commit 6421d36dd6
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
core/sme/src/csr/csr_api_scan.c
View file

@ -1214,6 +1214,7 @@ void csr_scan_callback(struct wlan_objmgr_vdev *vdev,
struct csr_roam_session *session;
uint32_t session_id = 0;
uint8_t chan = 0;
QDF_STATUS status;
bool success = false;
mac_ctx = (struct mac_context *)arg;
@ -1228,10 +1229,16 @@ void csr_scan_callback(struct wlan_objmgr_vdev *vdev,
scan_status = eCSR_SCAN_SUCCESS;
session_id = wlan_vdev_get_id(vdev);
status = sme_acquire_global_lock(&mac_ctx->sme);
if (QDF_IS_STATUS_ERROR(status))
return;
if (!CSR_IS_SESSION_VALID(mac_ctx, session_id)) {
sme_err("session %d is invalid", session_id);
sme_release_global_lock(&mac_ctx->sme);
return;
}
session = CSR_GET_SESSION(mac_ctx, session_id);
sme_debug("Scan Completion: status %d session %d scan_id %d",
@ -1241,6 +1248,7 @@ void csr_scan_callback(struct wlan_objmgr_vdev *vdev,
if (session->scan_info.scan_id != event->scan_id) {
sme_debug("Scan Completion on wrong scan_id %d, expected %d",
session->scan_info.scan_id, event->scan_id);
sme_release_global_lock(&mac_ctx->sme);
return;
}
#ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
@ -1252,6 +1260,8 @@ void csr_scan_callback(struct wlan_objmgr_vdev *vdev,
/* We reuse the command here instead reissue a new command */
csr_handle_nxt_cmd(mac_ctx, NextCommand,
session_id, chan);
sme_release_global_lock(&mac_ctx->sme);
}
tCsrScanResultInfo *csr_scan_result_get_first(struct mac_context *mac,