From b0844bbd5e4a6f0c1d11bf5c0cceb59b395bdbe0 Mon Sep 17 00:00:00 2001 From: "Poddar, Siddarth" Date: Thu, 9 Feb 2017 15:42:10 +0530 Subject: [PATCH] qcacld-3.0: De-reference tso list element after NULL check De-reference tso list element in ol_tso_seg_list_init and ol_tso_num_seg_list_init functions after NULL check. Change-Id: I89581e5c57275804d967ab734d6bcc714b6745e4 CRs-Fixed: 2004503 --- core/dp/txrx/ol_tx.c | 65 ++++++++++++++++++++++++++++++++++++++------ 1 file changed, 56 insertions(+), 9 deletions(-) diff --git a/core/dp/txrx/ol_tx.c b/core/dp/txrx/ol_tx.c index a9d1bc5ac422..2f492b430c89 100644 --- a/core/dp/txrx/ol_tx.c +++ b/core/dp/txrx/ol_tx.c @@ -1879,12 +1879,21 @@ qdf_nbuf_t ol_tx_reinject(struct ol_txrx_vdev_t *vdev, */ void ol_tso_seg_list_init(struct ol_txrx_pdev_t *pdev, uint32_t num_seg) { - int i; + int i = 0; struct qdf_tso_seg_elem_t *c_element; + /* Host should not allocate any c_element. */ + if (num_seg <= 0) { + TXRX_PRINT(TXRX_PRINT_LEVEL_ERR, + "%s: ERROR: Pool size passed is 0", + __func__); + QDF_BUG(0); + pdev->tso_seg_pool.pool_size = i; + qdf_spinlock_create(&pdev->tso_seg_pool.tso_mutex); + return; + } + c_element = qdf_mem_malloc(sizeof(struct qdf_tso_seg_elem_t)); - c_element->on_freelist = 1; - c_element->cookie = TSO_SEG_MAGIC_COOKIE; pdev->tso_seg_pool.freelist = c_element; for (i = 0; i < (num_seg - 1); i++) { if (qdf_unlikely(!c_element)) { @@ -1897,13 +1906,28 @@ void ol_tso_seg_list_init(struct ol_txrx_pdev_t *pdev, uint32_t num_seg) return; } /* set the freelist bit and magic cookie*/ + c_element->on_freelist = 1; + c_element->cookie = TSO_SEG_MAGIC_COOKIE; c_element->next = qdf_mem_malloc(sizeof(struct qdf_tso_seg_elem_t)); c_element = c_element->next; - c_element->on_freelist = 1; - c_element->cookie = TSO_SEG_MAGIC_COOKIE; - c_element->next = NULL; } + /* + * NULL check for the last c_element of the list or + * first c_element if num_seg is equal to 1. + */ + if (qdf_unlikely(!c_element)) { + TXRX_PRINT(TXRX_PRINT_LEVEL_ERR, + "%s: ERROR: c_element NULL for seg %d", + __func__, i); + QDF_BUG(0); + pdev->tso_seg_pool.pool_size = i; + qdf_spinlock_create(&pdev->tso_seg_pool.tso_mutex); + return; + } + c_element->on_freelist = 1; + c_element->cookie = TSO_SEG_MAGIC_COOKIE; + c_element->next = NULL; pdev->tso_seg_pool.pool_size = num_seg; qdf_spinlock_create(&pdev->tso_seg_pool.tso_mutex); } @@ -1965,9 +1989,20 @@ void ol_tso_seg_list_deinit(struct ol_txrx_pdev_t *pdev) */ void ol_tso_num_seg_list_init(struct ol_txrx_pdev_t *pdev, uint32_t num_seg) { - int i; + int i = 0; struct qdf_tso_num_seg_elem_t *c_element; + /* Host should not allocate any c_element. */ + if (num_seg <= 0) { + TXRX_PRINT(TXRX_PRINT_LEVEL_ERR, + "%s: ERROR: Pool size passed is 0", + __func__); + QDF_BUG(0); + pdev->tso_num_seg_pool.num_seg_pool_size = i; + qdf_spinlock_create(&pdev->tso_num_seg_pool.tso_num_seg_mutex); + return; + } + c_element = qdf_mem_malloc(sizeof(struct qdf_tso_num_seg_elem_t)); pdev->tso_num_seg_pool.freelist = c_element; for (i = 0; i < (num_seg - 1); i++) { @@ -1981,12 +2016,24 @@ void ol_tso_num_seg_list_init(struct ol_txrx_pdev_t *pdev, uint32_t num_seg) tso_num_seg_mutex); return; } - c_element->next = qdf_mem_malloc(sizeof(struct qdf_tso_num_seg_elem_t)); c_element = c_element->next; - c_element->next = NULL; } + /* + * NULL check for the last c_element of the list or + * first c_element if num_seg is equal to 1. + */ + if (qdf_unlikely(!c_element)) { + TXRX_PRINT(TXRX_PRINT_LEVEL_ERR, + "%s: ERROR: c_element NULL for num of seg %d", + __func__, i); + QDF_BUG(0); + pdev->tso_num_seg_pool.num_seg_pool_size = i; + qdf_spinlock_create(&pdev->tso_num_seg_pool.tso_num_seg_mutex); + return; + } + c_element->next = NULL; pdev->tso_num_seg_pool.num_seg_pool_size = num_seg; qdf_spinlock_create(&pdev->tso_num_seg_pool.tso_num_seg_mutex); }