A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 22:40:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: htc: Fix race while processing HTC control messages

Browse source 
HTC control messages ready and connect service indications use
CtrlResponseBuffer for processing the HTC messages. Flag
CtrlResponseProcessing is used to protect this buffer from
overwriting before processing. Current implementation has race
condition as setting the flag happens on waiting thread context
instead of receive thread context so this could lead to
overwriting the CtrlResponseBuffer if waiting thread doesn't get
chance to run because of may be another RX interrupt.
Also to catch this kind of issues, add CDF_BUG so that it is
easier to triage the cause for the malformed packet which is not
expected.

CRs-fixed: 881504
Change-Id: Ia279e08c761a3432cf01d4dc129f7b5439d04680
This commit is contained in:
Prashanth Bhatta 2015-11-05 11:43:17 -08:00 • committed by Prakash Dhavali
commit 9dddcb2745
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
core/htc/htc_recv.c
View file

@ -418,6 +418,7 @@ CDF_STATUS htc_rx_completion_handler(void *Context, cdf_nbuf_t netbuf,
AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
("HTC Rx Ctrl still processing\n"));
status = CDF_STATUS_E_FAILURE;
CDF_BUG(false);
break;
}
@ -427,6 +428,9 @@ CDF_STATUS htc_rx_completion_handler(void *Context, cdf_nbuf_t netbuf,
HTC_MAX_CONTROL_MESSAGE_LENGTH);
A_MEMCPY(target->CtrlResponseBuffer, netdata,
target->CtrlResponseLength);
/* Requester will clear this flag */
target->CtrlResponseProcessing = true;
UNLOCK_HTC_RX(target);
cdf_semaphore_release(target->osdev,