A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-25 14:13:01 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Add msg.flush_callback for wma_send_msg_by_priority

Browse source 
If wma_send_msg with msg_type WMA_SET_LINK_STATE_RSP, tpLinkStateParams
params has a member callbackArg which is malloc from heap. If this
message is flushed when driver unload, because no msg.flush_callback is
supplied, the flush just free msg->bodyptr and callbackArg got leak.

Fix it by supply a flush_callback as wma_discard_fw_event, and minor
change to avoid NULL pointer access.

Change-Id: Ie979a1e83cbd7c87e5bbb08382ae2af3230a13db
CRs-Fixed: 2181458
This commit is contained in:
Will Huang 2018-02-02 17:55:15 +08:00 • committed by snandini
commit 9323e8559b
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
core/wma/src/wma_main.c
View file

@ -1775,6 +1775,9 @@ QDF_STATUS wma_process_hal_pwr_dbg_cmd(WMA_HANDLE handle,
static void wma_discard_fw_event(struct scheduler_msg *msg)
{
if (!msg->bodyptr)
return;
switch (msg->type) {
case WMA_PROCESS_FW_EVENT:
qdf_nbuf_free(((wma_process_fw_event_params *)msg->bodyptr)
@ -1784,8 +1787,8 @@ static void wma_discard_fw_event(struct scheduler_msg *msg)
qdf_mem_free(((tpLinkStateParams) msg->bodyptr)->callbackArg);
break;
}
if (msg->bodyptr)
qdf_mem_free(msg->bodyptr);
qdf_mem_free(msg->bodyptr);
msg->bodyptr = NULL;
msg->bodyval = 0;
msg->type = 0;
@ -3402,6 +3405,7 @@ void wma_send_msg_by_priority(tp_wma_handle wma_handle, uint16_t msg_type,
msg.type = msg_type;
msg.bodyval = body_val;
msg.bodyptr = body_ptr;
msg.flush_callback = wma_discard_fw_event;
status = scheduler_post_msg_by_priority(QDF_MODULE_ID_PE,
&msg, is_high_priority);