From 685afa3f7e8073d5b64b48e5ba572a5ba1140072 Mon Sep 17 00:00:00 2001 From: Yeshwanth Sriram Guntuka Date: Thu, 29 Apr 2021 13:31:58 +0530 Subject: [PATCH] qcacmn: Do not add nbuf to emerg_nbuf_q on free when not initialized When nbuf is freed via dp_rx_buffer_pool_nbuf_free, the nbuf is enqueued to emerg_nbuf_q always even in the case where the emerg_nbuf_q is not initialized. This will result in NULL pointer dereference when any nbuf is enqueued to emerg_nbuf_q. Fix is to add initialization check before adding the nbuf to emerg_nbuf_q and free the nbuf if emerg_nbuf_q is not initialized. Change-Id: I075b3b93203eec21d44ea3967b5f46d59c291a14 CRs-Fixed: 2934593 --- dp/wifi3.0/dp_rx_buffer_pool.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dp/wifi3.0/dp_rx_buffer_pool.c b/dp/wifi3.0/dp_rx_buffer_pool.c index cbc1e427c005..638d1941fa63 100644 --- a/dp/wifi3.0/dp_rx_buffer_pool.c +++ b/dp/wifi3.0/dp_rx_buffer_pool.c @@ -110,7 +110,8 @@ void dp_rx_buffer_pool_nbuf_free(struct dp_soc *soc, qdf_nbuf_t nbuf, u8 mac_id) buff_pool = &soc->rx_buff_pool[mac_id]; if (qdf_likely(qdf_nbuf_queue_head_qlen(&buff_pool->emerg_nbuf_q) >= - DP_RX_BUFFER_POOL_SIZE)) + DP_RX_BUFFER_POOL_SIZE) || + !buff_pool->is_initialized) return qdf_nbuf_free(nbuf); qdf_nbuf_reset(nbuf, RX_BUFFER_RESERVATION,