From 86657feebf0380c3ba3c4e2dd3a12d95a98ac96c Mon Sep 17 00:00:00 2001 From: bings Date: Tue, 31 Oct 2017 08:54:12 +0800 Subject: [PATCH] qcacld-3.0: Fix race condition between vendor scan and nl scan If vendor scan and nl scan happen and abort at the same time, before scan_block_work is scheduled, pAdapter->request may be set as vendor scan request firstly, then scan_block_work is scheduled while at the same time pAdapter->request may be as nl scan request by nl scan. This causes memory leak and incorrect scan done called. Change-Id: Id730f2d0041641099a26e76ab13ec419a48b4241 CRs-Fixed: 2134652 --- core/hdd/inc/wlan_hdd_main.h | 2 +- core/hdd/src/wlan_hdd_scan.c | 32 ++++++++++++++++++++++---------- 2 files changed, 23 insertions(+), 11 deletions(-) diff --git a/core/hdd/inc/wlan_hdd_main.h b/core/hdd/inc/wlan_hdd_main.h index c02d45a8a1d7..9fc7a1de21f3 100644 --- a/core/hdd/inc/wlan_hdd_main.h +++ b/core/hdd/inc/wlan_hdd_main.h @@ -991,7 +991,7 @@ struct hdd_adapter { /* TODO Move this to sta Ctx */ struct wireless_dev wdev; struct cfg80211_scan_request *request; - uint8_t scan_source; + struct cfg80211_scan_request *vendor_request; /** ops checks if Opportunistic Power Save is Enable or Not * ctw stores ctWindow value once we receive Opps command from diff --git a/core/hdd/src/wlan_hdd_scan.c b/core/hdd/src/wlan_hdd_scan.c index fe2888d25ef4..0c6503e73739 100644 --- a/core/hdd/src/wlan_hdd_scan.c +++ b/core/hdd/src/wlan_hdd_scan.c @@ -316,12 +316,18 @@ static void __wlan_hdd_cfg80211_scan_block_cb(struct work_struct *work) request->n_channels = 0; hdd_err("##In DFS Master mode. Scan aborted. Null result sent"); - if (NL_SCAN == adapter->scan_source) - hdd_cfg80211_scan_done(adapter, request, true); - else - hdd_vendor_scan_callback(adapter, request, true); + hdd_cfg80211_scan_done(adapter, request, true); adapter->request = NULL; } + request = adapter->vendor_request; + if (request) { + request->n_ssids = 0; + request->n_channels = 0; + + hdd_err("In DFS Master mode. Scan aborted. Null result sent"); + hdd_vendor_scan_callback(adapter, request, true); + adapter->vendor_request = NULL; + } } void wlan_hdd_cfg80211_scan_block_cb(struct work_struct *work) @@ -481,8 +487,10 @@ static int __wlan_hdd_cfg80211_scan(struct wiphy *wiphy, conn_info.connState) && (!hdd_ctx->config->enable_connected_scan)) { hdd_info("enable_connected_scan is false, Aborting scan"); - adapter->request = request; - adapter->scan_source = source; + if (NL_SCAN == source) + adapter->request = request; + else + adapter->vendor_request = request; schedule_work(&adapter->scan_block_work); return 0; } @@ -532,8 +540,10 @@ static int __wlan_hdd_cfg80211_scan(struct wiphy *wiphy, * startup. */ hdd_err("##In DFS Master mode. Scan aborted"); - adapter->request = request; - adapter->scan_source = source; + if (NL_SCAN == source) + adapter->request = request; + else + adapter->vendor_request = request; schedule_work(&adapter->scan_block_work); return 0; @@ -589,8 +599,10 @@ static int __wlan_hdd_cfg80211_scan(struct wiphy *wiphy, if (adapter->device_mode == QDF_SAP_MODE && wlan_hdd_sap_skip_scan_check(hdd_ctx, request)) { hdd_debug("sap scan skipped"); - adapter->request = request; - adapter->scan_source = source; + if (NL_SCAN == source) + adapter->request = request; + else + adapter->vendor_request = request; schedule_work(&adapter->scan_block_work); return 0; }