From 876fa6f2f9b40c086ff525af2cf0c83e8b89ed07 Mon Sep 17 00:00:00 2001 From: Alan Chen Date: Mon, 27 Jan 2020 10:36:39 -0800 Subject: [PATCH] qcacld-3.0: Pass a double pointer to sta_info in hdd_sta_info_detach() Data abort is happening while accessing unmapped sta_info in hdd_softap_stop_bss(). When calling hdd_sta_info_detach() through hdd_softap_deregister_sta(), sta_info is not being set to NULL since a single value only passes a copy of sta_info, so the actual sta_info is not actually being set to NULL. To fix this, pass a double pointer to sta_info instead of a single pointer so that it can be set to NULL. Change-Id: I96f4c7e1563e53498a86c95263dc62a8d3d68e21 CRs-Fixed: 2610763 --- core/hdd/src/wlan_hdd_hostapd.c | 2 +- core/hdd/src/wlan_hdd_softap_tx_rx.c | 2 +- core/hdd/src/wlan_hdd_sta_info.c | 12 ++++++------ core/hdd/src/wlan_hdd_sta_info.h | 4 ++-- core/hdd/src/wlan_hdd_station_info.c | 4 ++-- 5 files changed, 12 insertions(+), 12 deletions(-) diff --git a/core/hdd/src/wlan_hdd_hostapd.c b/core/hdd/src/wlan_hdd_hostapd.c index 8bee570c49c3..b7cd5ae01351 100644 --- a/core/hdd/src/wlan_hdd_hostapd.c +++ b/core/hdd/src/wlan_hdd_hostapd.c @@ -1557,7 +1557,7 @@ static void hdd_fill_station_info(struct hdd_adapter *adapter, /* Remove the oldest and store the current */ hdd_sta_info_detach(&adapter->cache_sta_info_list, - oldest_disassoc_sta_info); + &oldest_disassoc_sta_info); hdd_sta_info_attach(&adapter->cache_sta_info_list, cache_sta_info); } diff --git a/core/hdd/src/wlan_hdd_softap_tx_rx.c b/core/hdd/src/wlan_hdd_softap_tx_rx.c index e90ca709916e..83cc93d0ca97 100644 --- a/core/hdd/src/wlan_hdd_softap_tx_rx.c +++ b/core/hdd/src/wlan_hdd_softap_tx_rx.c @@ -1004,7 +1004,7 @@ QDF_STATUS hdd_softap_deregister_sta(struct hdd_adapter *adapter, mac_addr->bytes) != QDF_STATUS_SUCCESS) hdd_debug("WLAN_CLIENT_DISCONNECT event failed"); } - hdd_sta_info_detach(&adapter->sta_info_list, sta_info); + hdd_sta_info_detach(&adapter->sta_info_list, &sta_info); ucfg_mlme_update_oce_flags(hdd_ctx->pdev); diff --git a/core/hdd/src/wlan_hdd_sta_info.c b/core/hdd/src/wlan_hdd_sta_info.c index 9d9c75100117..2d07a386cd3b 100644 --- a/core/hdd/src/wlan_hdd_sta_info.c +++ b/core/hdd/src/wlan_hdd_sta_info.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2019 The Linux Foundation. All rights reserved. + * Copyright (c) 2019-2020 The Linux Foundation. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -73,7 +73,7 @@ QDF_STATUS hdd_sta_info_attach(struct hdd_sta_info_obj *sta_info_container, } void hdd_sta_info_detach(struct hdd_sta_info_obj *sta_info_container, - struct hdd_station_info *sta_info) + struct hdd_station_info **sta_info) { if (!sta_info_container || !sta_info) { hdd_err("Parameter(s) null"); @@ -82,12 +82,12 @@ void hdd_sta_info_detach(struct hdd_sta_info_obj *sta_info_container, qdf_spin_lock_bh(&sta_info_container->sta_obj_lock); - qdf_ht_remove(&sta_info->sta_node); + qdf_ht_remove(&((*sta_info)->sta_node)); qdf_spin_unlock_bh(&sta_info_container->sta_obj_lock); - qdf_mem_free(sta_info); - sta_info = NULL; + qdf_mem_free(*sta_info); + *sta_info = NULL; } struct hdd_station_info *hdd_get_sta_info_by_mac( @@ -131,7 +131,7 @@ void hdd_clear_cached_sta_info(struct hdd_sta_info_obj *sta_info_container) qdf_ht_for_each_safe(sta_info_container->sta_obj, index, tmp, sta_info, sta_node) { if (sta_info) { - hdd_sta_info_detach(sta_info_container, sta_info); + hdd_sta_info_detach(sta_info_container, &sta_info); } } } diff --git a/core/hdd/src/wlan_hdd_sta_info.h b/core/hdd/src/wlan_hdd_sta_info.h index 529805cf112f..1a356676cc9f 100644 --- a/core/hdd/src/wlan_hdd_sta_info.h +++ b/core/hdd/src/wlan_hdd_sta_info.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2019 The Linux Foundation. All rights reserved. + * Copyright (c) 2019-2020 The Linux Foundation. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -240,7 +240,7 @@ void hdd_sta_info_deinit(struct hdd_sta_info_obj *sta_info_container); * Return: None */ void hdd_sta_info_detach(struct hdd_sta_info_obj *sta_info_container, - struct hdd_station_info *sta_info); + struct hdd_station_info **sta_info); /** * hdd_sta_info_attach() - Attach the station info structure into the list diff --git a/core/hdd/src/wlan_hdd_station_info.c b/core/hdd/src/wlan_hdd_station_info.c index 076f2c571c95..7fa361b4e106 100644 --- a/core/hdd/src/wlan_hdd_station_info.c +++ b/core/hdd/src/wlan_hdd_station_info.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012-2019 The Linux Foundation. All rights reserved. + * Copyright (c) 2012-2020 The Linux Foundation. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -1084,7 +1084,7 @@ static int hdd_get_cached_station_remote(struct hdd_context *hdd_ctx, } } - hdd_sta_info_detach(&adapter->cache_sta_info_list, stainfo); + hdd_sta_info_detach(&adapter->cache_sta_info_list, &stainfo); qdf_atomic_dec(&adapter->cache_sta_count); return cfg80211_vendor_cmd_reply(skb);