From 832737116d2d52a461fc22ee7a9873a4c3a14161 Mon Sep 17 00:00:00 2001 From: Zhu Jianmin Date: Tue, 27 Mar 2018 16:24:24 +0800 Subject: [PATCH] qcacmn: Fix scan db mem leak in race condition During module stop, scan db is cleared before scheduler thread stop, new beacon can be handled and scan node still can be added into scan db after scan db clear in race condition, result in mem leak. Fixed by moving scm_db_deinit from ucfg_scan_psoc_disable to ucfg_scan_psoc_close, which is called after scheduler thread stop To be symmetrical, move scm_db_init from ucfg_scan_psoc_enable to ucfg_scan_psoc_open. Call stack: hdd_wlan_stop_modules ->hdd_deconfigure_cds ->cds_disable ->dispatcher_psoc_disable ->ucfg_scan_psoc_disable ->scm_db_deinit ->cds_close ->dispatcher_disable ->scheduler_disable ->dispatcher_psoc_close ->ucfg_scan_psoc_close scheduler_thread ->scheduler_thread_process_queues ->scheduler_target_if_mq_handler ->target_if_msg_handler ->scm_handle_bcn_probe ->scm_add_update_entry ->scm_add_scan_entry Change-Id: I911751a247ae3ccb489755c30ffbe078a93ca4db CRs-Fixed: 2205354 --- umac/scan/dispatcher/src/wlan_scan_ucfg_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/umac/scan/dispatcher/src/wlan_scan_ucfg_api.c b/umac/scan/dispatcher/src/wlan_scan_ucfg_api.c index 755be86695c8..ba94412312f5 100644 --- a/umac/scan/dispatcher/src/wlan_scan_ucfg_api.c +++ b/umac/scan/dispatcher/src/wlan_scan_ucfg_api.c @@ -1963,6 +1963,7 @@ ucfg_scan_psoc_open(struct wlan_objmgr_psoc *psoc) wlan_scan_global_init(scan_obj); qdf_spinlock_create(&scan_obj->lock); ucfg_scan_register_pmo_handler(); + scm_db_init(psoc); return QDF_STATUS_SUCCESS; } @@ -1977,6 +1978,7 @@ ucfg_scan_psoc_close(struct wlan_objmgr_psoc *psoc) scm_err("null psoc"); return QDF_STATUS_E_FAILURE; } + scm_db_deinit(psoc); scan_obj = wlan_psoc_get_scan_obj(psoc); if (scan_obj == NULL) { scm_err("Failed to get scan object"); @@ -2027,7 +2029,6 @@ ucfg_scan_psoc_enable(struct wlan_objmgr_psoc *psoc) /* Subscribe for scan events from lmac layesr */ status = tgt_scan_register_ev_handler(psoc); QDF_ASSERT(status == QDF_STATUS_SUCCESS); - scm_db_init(psoc); if (wlan_reg_11d_original_enabled_on_host(psoc)) scm_11d_cc_db_init(psoc); ucfg_scan_register_unregister_bcn_cb(psoc, true); @@ -2054,7 +2055,6 @@ ucfg_scan_psoc_disable(struct wlan_objmgr_psoc *psoc) ucfg_scan_register_unregister_bcn_cb(psoc, false); if (wlan_reg_11d_original_enabled_on_host(psoc)) scm_11d_cc_db_deinit(psoc); - scm_db_deinit(psoc); return status; }