From 8a06d83ca82d6c105247a6b5a3e6c2615177d209 Mon Sep 17 00:00:00 2001 From: Krunal Soni Date: Wed, 20 Jun 2018 16:41:17 -0700 Subject: [PATCH] qcacld-3.0: Don't process scan command when vdev delete is in process When driver performs vdev delete operation, it changes vdev state to logically deleted or physically deleted only after receiving vdev delete command's response from FW. In between (sending vdev del req and receiving vdev del rsp) if thread gets pre-empted and other thread start posting command (like scan command) to process then it could lead to use after free scenario. Notify scan component when vdev delete is intiated and let scan component record that in to vdev's scan private object as one of the flags. check this flag before processing the scan command. CRs-Fixed: 2265542 Change-Id: Id884d6c42cd8766e70835808863632e096158487 --- core/hdd/src/wlan_hdd_main.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/core/hdd/src/wlan_hdd_main.c b/core/hdd/src/wlan_hdd_main.c index 29720fe45918..f9bdec8e642d 100644 --- a/core/hdd/src/wlan_hdd_main.c +++ b/core/hdd/src/wlan_hdd_main.c @@ -3852,6 +3852,7 @@ int hdd_vdev_destroy(struct hdd_adapter *adapter) return -EINVAL; } status = ucfg_reg_11d_vdev_delete_update(adapter->hdd_vdev); + ucfg_scan_set_vdev_del_in_progress(adapter->hdd_vdev); /* close sme session (destroy vdev in firmware via legacy API) */ qdf_event_reset(&adapter->qdf_session_close_event); @@ -3888,6 +3889,7 @@ int hdd_vdev_destroy(struct hdd_adapter *adapter) } release_vdev: + ucfg_scan_clear_vdev_del_in_progress(adapter->hdd_vdev); /* * In SSR or driver unloading case, directly exit may cause objects * leak, if sme_close_session failed. Free objects anyway.