A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Don't process scan command when vdev delete is in process

Browse source 
When driver performs vdev delete operation, it changes vdev state
to logically deleted or physically deleted only after receiving vdev
delete command's response from FW. In between (sending vdev del req
and receiving vdev del rsp) if thread gets pre-empted and other thread
start posting command (like scan command) to process then it could
lead to use after free scenario.

Notify scan component when vdev delete is intiated and let scan
component record that in to vdev's scan private object as one of the
flags.

check this flag before processing the scan command.

CRs-Fixed: 2265542
Change-Id: Id884d6c42cd8766e70835808863632e096158487
This commit is contained in:
Krunal Soni 2018-06-20 16:41:17 -07:00 • committed by nshrivas
commit 8a06d83ca8
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
core/hdd/src/wlan_hdd_main.c
View file

@ -3852,6 +3852,7 @@ int hdd_vdev_destroy(struct hdd_adapter *adapter)
return -EINVAL;
}
status = ucfg_reg_11d_vdev_delete_update(adapter->hdd_vdev);
ucfg_scan_set_vdev_del_in_progress(adapter->hdd_vdev);
/* close sme session (destroy vdev in firmware via legacy API) */
qdf_event_reset(&adapter->qdf_session_close_event);
@ -3888,6 +3889,7 @@ int hdd_vdev_destroy(struct hdd_adapter *adapter)
}
release_vdev:
ucfg_scan_clear_vdev_del_in_progress(adapter->hdd_vdev);
/*
* In SSR or driver unloading case, directly exit may cause objects
* leak, if sme_close_session failed. Free objects anyway.