From 9dddcb2745f5a0ef2b79e89841106b66781b1abd Mon Sep 17 00:00:00 2001 From: Prashanth Bhatta Date: Thu, 5 Nov 2015 11:43:17 -0800 Subject: [PATCH] qcacld-3.0: htc: Fix race while processing HTC control messages HTC control messages ready and connect service indications use CtrlResponseBuffer for processing the HTC messages. Flag CtrlResponseProcessing is used to protect this buffer from overwriting before processing. Current implementation has race condition as setting the flag happens on waiting thread context instead of receive thread context so this could lead to overwriting the CtrlResponseBuffer if waiting thread doesn't get chance to run because of may be another RX interrupt. Also to catch this kind of issues, add CDF_BUG so that it is easier to triage the cause for the malformed packet which is not expected. CRs-fixed: 881504 Change-Id: Ia279e08c761a3432cf01d4dc129f7b5439d04680 --- core/htc/htc_recv.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/core/htc/htc_recv.c b/core/htc/htc_recv.c index 3418aac136fe..38f13768f1dd 100644 --- a/core/htc/htc_recv.c +++ b/core/htc/htc_recv.c @@ -418,6 +418,7 @@ CDF_STATUS htc_rx_completion_handler(void *Context, cdf_nbuf_t netbuf, AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HTC Rx Ctrl still processing\n")); status = CDF_STATUS_E_FAILURE; + CDF_BUG(false); break; } @@ -427,6 +428,9 @@ CDF_STATUS htc_rx_completion_handler(void *Context, cdf_nbuf_t netbuf, HTC_MAX_CONTROL_MESSAGE_LENGTH); A_MEMCPY(target->CtrlResponseBuffer, netdata, target->CtrlResponseLength); + + /* Requester will clear this flag */ + target->CtrlResponseProcessing = true; UNLOCK_HTC_RX(target); cdf_semaphore_release(target->osdev,