A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 06:09:23 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Get proper umac_cmd in CSR serialization util cmds

Browse source 
In csr_nonscan_pending_ll_next/csr_nonscan_pending_ll_peek_head and
csr_nonscan_active_ll_peek_head all commands umac_cmd is mapped
to tSmeCmd. This can lead to invalid pointer access as umac_cmd
can be of different type and does not always map to tSmeCmd.

Thus return the cmds only with source WLAN_UMAC_COMP_MLME, which are
initiated by sme and has tSmeCmd mapped to umac_cmd.

Change-Id: I73e75ef5ea754f4ef548a1cb9b3de2d0e566adf6
CRs-Fixed: 2655838
This commit is contained in:
gaurank kathpalia 2020-04-02 14:17:20 +05:30 • committed by nshrivas
commit 893fe5bc0c
3 changed files with 32 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

23
core/sme/src/common/sme_api.c
View file

@ -8296,31 +8296,32 @@ QDF_STATUS sme_set_wlm_latency_level(mac_handle_t mac_handle,
void sme_get_command_q_status(mac_handle_t mac_handle)
{
tSmeCmd *pTempCmd = NULL;
tListElem *pEntry;
struct mac_context *mac;
struct wlan_serialization_command *cmd;
if (!mac_handle)
return;
mac = MAC_CONTEXT(mac_handle);
pEntry = csr_nonscan_active_ll_peek_head(mac, LL_ACCESS_LOCK);
if (pEntry)
pTempCmd = GET_BASE_ADDR(pEntry, tSmeCmd, Link);
sme_info("smeCmdPendingList has %d commands",
wlan_serialization_get_pending_list_count(mac->psoc, false));
cmd = wlan_serialization_peek_head_active_cmd_using_psoc(mac->psoc,
false);
if (cmd)
sme_info("Active commaned is %d cmd id %d source %d",
cmd->cmd_type, cmd->cmd_id, cmd->source);
if (!cmd || cmd->source != WLAN_UMAC_COMP_MLME)
return;
sme_info("smeCmdActiveList has command (0x%X)",
(pTempCmd) ? pTempCmd->command : eSmeNoCommand);
pTempCmd = cmd->umac_cmd;
if (pTempCmd) {
if (eSmeCsrCommandMask & pTempCmd->command)
/* CSR command is stuck. See what the reason code is
* for that command
*/
dump_csr_command_info(mac, pTempCmd);
} /* if(pTempCmd) */
sme_info("smeCmdPendingList has %d commands",
wlan_serialization_get_pending_list_count(mac->psoc, false));
}
}
#ifdef WLAN_FEATURE_DSRC

1
core/sme/src/csr/csr_api_roam.c
View file

@ -19881,6 +19881,7 @@ QDF_STATUS csr_set_serialization_params_to_cmd(struct mac_context *mac_ctx,
csr_fill_cmd_timeout(cmd);
cmd->source = WLAN_UMAC_COMP_MLME;
cmd->cmd_cb = sme_ser_cmd_callback;
cmd->is_high_priority = high_priority;
cmd->is_blocking = true;

30
core/sme/src/csr/csr_util.c
View file

@ -445,7 +445,7 @@ tListElem *csr_nonscan_active_ll_peek_head(struct mac_context *mac_ctx,
cmd = wlan_serialization_peek_head_active_cmd_using_psoc(mac_ctx->psoc,
false);
if (!cmd)
if (!cmd || cmd->source != WLAN_UMAC_COMP_MLME)
return NULL;
sme_cmd = cmd->umac_cmd;
@ -461,12 +461,16 @@ tListElem *csr_nonscan_pending_ll_peek_head(struct mac_context *mac_ctx,
cmd = wlan_serialization_peek_head_pending_cmd_using_psoc(mac_ctx->psoc,
false);
if (!cmd)
return NULL;
while (cmd) {
if (cmd->source == WLAN_UMAC_COMP_MLME) {
sme_cmd = cmd->umac_cmd;
return &sme_cmd->Link;
}
cmd = wlan_serialization_get_pending_list_next_node_using_psoc(
mac_ctx->psoc, cmd, false);
}
sme_cmd = cmd->umac_cmd;
return &sme_cmd->Link;
return NULL;
}
bool csr_nonscan_active_ll_remove_entry(struct mac_context *mac_ctx,
@ -499,12 +503,16 @@ tListElem *csr_nonscan_pending_ll_next(struct mac_context *mac_ctx,
mac_ctx->psoc, &cmd, false);
if (cmd.vdev)
wlan_objmgr_vdev_release_ref(cmd.vdev, WLAN_LEGACY_SME_ID);
if (!tcmd) {
sme_err("No cmd found");
return NULL;
while (tcmd) {
if (tcmd->source == WLAN_UMAC_COMP_MLME) {
sme_cmd = tcmd->umac_cmd;
return &sme_cmd->Link;
}
tcmd = wlan_serialization_get_pending_list_next_node_using_psoc(
mac_ctx->psoc, tcmd, false);
}
sme_cmd = tcmd->umac_cmd;
return &sme_cmd->Link;
return NULL;
}
bool csr_get_bss_id_bss_desc(struct bss_description *pSirBssDesc,