From 6421d36dd6ec65071aedbc8feb1e676f3d866f05 Mon Sep 17 00:00:00 2001 From: Abhinav Kumar Date: Thu, 17 Oct 2019 14:22:24 +0530 Subject: [PATCH] qcacld-3.0: Protect csr_scan_callback with sme lock In csr_scan_callback sme lock is not taken and csr session is accessed without taking the lock. This may lead to race where a north bound thread and scheduler thread might modify the same param at a time. Thus if a new connect request is received at same time which also lead to scan for ssid, scheduler and the NB thread may try to free session->scan_info.profile at same time leading to double free. Fix is to protect csr_scan_callback with sme lock. Change-Id: I44519f53f41b94a1ba6420efef2d35a98a7bcaf5 CRs-Fixed: 2547428 --- core/sme/src/csr/csr_api_scan.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/core/sme/src/csr/csr_api_scan.c b/core/sme/src/csr/csr_api_scan.c index f4ac7455a3aa..379f9eab22aa 100644 --- a/core/sme/src/csr/csr_api_scan.c +++ b/core/sme/src/csr/csr_api_scan.c @@ -1214,6 +1214,7 @@ void csr_scan_callback(struct wlan_objmgr_vdev *vdev, struct csr_roam_session *session; uint32_t session_id = 0; uint8_t chan = 0; + QDF_STATUS status; bool success = false; mac_ctx = (struct mac_context *)arg; @@ -1228,10 +1229,16 @@ void csr_scan_callback(struct wlan_objmgr_vdev *vdev, scan_status = eCSR_SCAN_SUCCESS; session_id = wlan_vdev_get_id(vdev); + status = sme_acquire_global_lock(&mac_ctx->sme); + if (QDF_IS_STATUS_ERROR(status)) + return; + if (!CSR_IS_SESSION_VALID(mac_ctx, session_id)) { sme_err("session %d is invalid", session_id); + sme_release_global_lock(&mac_ctx->sme); return; } + session = CSR_GET_SESSION(mac_ctx, session_id); sme_debug("Scan Completion: status %d session %d scan_id %d", @@ -1241,6 +1248,7 @@ void csr_scan_callback(struct wlan_objmgr_vdev *vdev, if (session->scan_info.scan_id != event->scan_id) { sme_debug("Scan Completion on wrong scan_id %d, expected %d", session->scan_info.scan_id, event->scan_id); + sme_release_global_lock(&mac_ctx->sme); return; } #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR @@ -1252,6 +1260,8 @@ void csr_scan_callback(struct wlan_objmgr_vdev *vdev, /* We reuse the command here instead reissue a new command */ csr_handle_nxt_cmd(mac_ctx, NextCommand, session_id, chan); + + sme_release_global_lock(&mac_ctx->sme); } tCsrScanResultInfo *csr_scan_result_get_first(struct mac_context *mac,