From 893fe5bc0cea0c8d10689ddebf885aa4a6e53559 Mon Sep 17 00:00:00 2001 From: gaurank kathpalia Date: Thu, 2 Apr 2020 14:17:20 +0530 Subject: [PATCH] qcacld-3.0: Get proper umac_cmd in CSR serialization util cmds In csr_nonscan_pending_ll_next/csr_nonscan_pending_ll_peek_head and csr_nonscan_active_ll_peek_head all commands umac_cmd is mapped to tSmeCmd. This can lead to invalid pointer access as umac_cmd can be of different type and does not always map to tSmeCmd. Thus return the cmds only with source WLAN_UMAC_COMP_MLME, which are initiated by sme and has tSmeCmd mapped to umac_cmd. Change-Id: I73e75ef5ea754f4ef548a1cb9b3de2d0e566adf6 CRs-Fixed: 2655838 --- core/sme/src/common/sme_api.c | 23 ++++++++++++----------- core/sme/src/csr/csr_api_roam.c | 1 + core/sme/src/csr/csr_util.c | 30 +++++++++++++++++++----------- 3 files changed, 32 insertions(+), 22 deletions(-) diff --git a/core/sme/src/common/sme_api.c b/core/sme/src/common/sme_api.c index cbfab3685eea..57afb30fe563 100644 --- a/core/sme/src/common/sme_api.c +++ b/core/sme/src/common/sme_api.c @@ -8296,31 +8296,32 @@ QDF_STATUS sme_set_wlm_latency_level(mac_handle_t mac_handle, void sme_get_command_q_status(mac_handle_t mac_handle) { tSmeCmd *pTempCmd = NULL; - tListElem *pEntry; struct mac_context *mac; + struct wlan_serialization_command *cmd; if (!mac_handle) return; mac = MAC_CONTEXT(mac_handle); - pEntry = csr_nonscan_active_ll_peek_head(mac, LL_ACCESS_LOCK); - if (pEntry) - pTempCmd = GET_BASE_ADDR(pEntry, tSmeCmd, Link); + sme_info("smeCmdPendingList has %d commands", + wlan_serialization_get_pending_list_count(mac->psoc, false)); + cmd = wlan_serialization_peek_head_active_cmd_using_psoc(mac->psoc, + false); + if (cmd) + sme_info("Active commaned is %d cmd id %d source %d", + cmd->cmd_type, cmd->cmd_id, cmd->source); + if (!cmd || cmd->source != WLAN_UMAC_COMP_MLME) + return; - sme_info("smeCmdActiveList has command (0x%X)", - (pTempCmd) ? pTempCmd->command : eSmeNoCommand); + pTempCmd = cmd->umac_cmd; if (pTempCmd) { if (eSmeCsrCommandMask & pTempCmd->command) /* CSR command is stuck. See what the reason code is * for that command */ dump_csr_command_info(mac, pTempCmd); - } /* if(pTempCmd) */ - - sme_info("smeCmdPendingList has %d commands", - wlan_serialization_get_pending_list_count(mac->psoc, false)); - + } } #ifdef WLAN_FEATURE_DSRC diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c index f5781a44721e..e7230e75555c 100644 --- a/core/sme/src/csr/csr_api_roam.c +++ b/core/sme/src/csr/csr_api_roam.c @@ -19881,6 +19881,7 @@ QDF_STATUS csr_set_serialization_params_to_cmd(struct mac_context *mac_ctx, csr_fill_cmd_timeout(cmd); + cmd->source = WLAN_UMAC_COMP_MLME; cmd->cmd_cb = sme_ser_cmd_callback; cmd->is_high_priority = high_priority; cmd->is_blocking = true; diff --git a/core/sme/src/csr/csr_util.c b/core/sme/src/csr/csr_util.c index b69ce6ac75e3..3a4a3840fb9f 100644 --- a/core/sme/src/csr/csr_util.c +++ b/core/sme/src/csr/csr_util.c @@ -445,7 +445,7 @@ tListElem *csr_nonscan_active_ll_peek_head(struct mac_context *mac_ctx, cmd = wlan_serialization_peek_head_active_cmd_using_psoc(mac_ctx->psoc, false); - if (!cmd) + if (!cmd || cmd->source != WLAN_UMAC_COMP_MLME) return NULL; sme_cmd = cmd->umac_cmd; @@ -461,12 +461,16 @@ tListElem *csr_nonscan_pending_ll_peek_head(struct mac_context *mac_ctx, cmd = wlan_serialization_peek_head_pending_cmd_using_psoc(mac_ctx->psoc, false); - if (!cmd) - return NULL; + while (cmd) { + if (cmd->source == WLAN_UMAC_COMP_MLME) { + sme_cmd = cmd->umac_cmd; + return &sme_cmd->Link; + } + cmd = wlan_serialization_get_pending_list_next_node_using_psoc( + mac_ctx->psoc, cmd, false); + } - sme_cmd = cmd->umac_cmd; - - return &sme_cmd->Link; + return NULL; } bool csr_nonscan_active_ll_remove_entry(struct mac_context *mac_ctx, @@ -499,12 +503,16 @@ tListElem *csr_nonscan_pending_ll_next(struct mac_context *mac_ctx, mac_ctx->psoc, &cmd, false); if (cmd.vdev) wlan_objmgr_vdev_release_ref(cmd.vdev, WLAN_LEGACY_SME_ID); - if (!tcmd) { - sme_err("No cmd found"); - return NULL; + while (tcmd) { + if (tcmd->source == WLAN_UMAC_COMP_MLME) { + sme_cmd = tcmd->umac_cmd; + return &sme_cmd->Link; + } + tcmd = wlan_serialization_get_pending_list_next_node_using_psoc( + mac_ctx->psoc, tcmd, false); } - sme_cmd = tcmd->umac_cmd; - return &sme_cmd->Link; + + return NULL; } bool csr_get_bss_id_bss_desc(struct bss_description *pSirBssDesc,