From 6e000465fa140df791604f2dc33e383b1ba07bf7 Mon Sep 17 00:00:00 2001 From: Yu Tian Date: Tue, 11 May 2021 14:44:11 +0800 Subject: [PATCH] qcacmn: avoid of HTC buffer double free in HTC send failure case HTC buffer is freed in enqueue failure case. Then it is requeued to htt_htc_pkt_misclist also. In deinit flow, misclist entry should be cleared, so buffer double free is hit in this stage. Make a change to not requeue this frame to misclist. Change-Id: I0211c4b548d7df7176ee72a83e21f8fcf7fa464c CRs-Fixed: 2942972 --- dp/wifi3.0/dp_htt.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/dp/wifi3.0/dp_htt.c b/dp/wifi3.0/dp_htt.c index a441ecb4b004..b46dc9b2b7e0 100644 --- a/dp/wifi3.0/dp_htt.c +++ b/dp/wifi3.0/dp_htt.c @@ -50,6 +50,10 @@ #define HTT_SHIFT_UPPER_TIMESTAMP 32 #define HTT_MASK_UPPER_TIMESTAMP 0xFFFFFFFF00000000 +#define HTT_HTC_PKT_STATUS_SUCCESS \ + ((pkt->htc_pkt.Status != QDF_STATUS_E_CANCELED) && \ + (pkt->htc_pkt.Status != QDF_STATUS_E_RESOURCES)) + /* * dp_htt_get_ppdu_sniffer_ampdu_tlv_bitmap() - Get ppdu stats tlv * bitmap for sniffer mode @@ -619,7 +623,7 @@ static inline QDF_STATUS DP_HTT_SEND_HTC_PKT(struct htt_soc *soc, htt_command_record(soc->htt_logger_handle, cmd, buf); status = htc_send_pkt(soc->htc_soc, &pkt->htc_pkt); - if (status == QDF_STATUS_SUCCESS) + if (status == QDF_STATUS_SUCCESS && HTT_HTC_PKT_STATUS_SUCCESS) htt_htc_misc_pkt_list_add(soc, pkt); else soc->stats.fail_count++;