A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-26 06:33:19 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Do not add nbuf to emerg_nbuf_q on free when not initialized

Browse source 
When nbuf is freed via dp_rx_buffer_pool_nbuf_free, the
nbuf is enqueued to emerg_nbuf_q always even in the case
where the emerg_nbuf_q is not initialized. This will result
in NULL pointer dereference when any nbuf is enqueued to
emerg_nbuf_q.

Fix is to add initialization check before adding the nbuf
to emerg_nbuf_q and free the nbuf if emerg_nbuf_q is not
initialized.

Change-Id: I075b3b93203eec21d44ea3967b5f46d59c291a14
CRs-Fixed: 2934593
This commit is contained in:
Yeshwanth Sriram Guntuka 2021-04-29 13:31:58 +05:30 • committed by Madan Koyyalamudi
commit 685afa3f7e
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
dp/wifi3.0/dp_rx_buffer_pool.c
View file

@ -110,7 +110,8 @@ void dp_rx_buffer_pool_nbuf_free(struct dp_soc *soc, qdf_nbuf_t nbuf, u8 mac_id)
buff_pool = &soc->rx_buff_pool[mac_id];
if (qdf_likely(qdf_nbuf_queue_head_qlen(&buff_pool->emerg_nbuf_q) >=
DP_RX_BUFFER_POOL_SIZE))
DP_RX_BUFFER_POOL_SIZE) ||
!buff_pool->is_initialized)
return qdf_nbuf_free(nbuf);
qdf_nbuf_reset(nbuf, RX_BUFFER_RESERVATION,