A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-25 14:13:01 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Resolve double free during cleanup of vdev request

Browse source 
On vdev response timer expire, memory allocated for vdev request
will be freed in the timer handler(wma_vdev_resp_timer). But there
can be a race condition where wlan shutdown is invoked at the same
time, where host tried to cleanup unhandled vdev requests by calling
same timer handler.

To mitigate this issue don't free the memory if vdev request is not
found(as other thread freed memory by this time)

Change-Id: Iea214f0ed3acb9600b5a3b84b5740c1b496719d9
CRs-Fixed: 2049673
This commit is contained in:
Houston Hoffman 2017-05-18 15:07:51 -07:00 • committed by Nandini Suresh
commit b4558eb67e
1 changed files with 8 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

17
core/wma/src/wma_dev_if.c
View file

@ -2950,15 +2950,6 @@ void wma_vdev_resp_timer(void *data)
goto free_tgt_req;
}
pdev = cds_get_context(QDF_MODULE_ID_TXRX);
if (NULL == pdev) {
WMA_LOGE("%s: Failed to get pdev", __func__);
wma_cleanup_target_req_param(tgt_req);
qdf_mc_timer_stop(&tgt_req->event_timeout);
goto free_tgt_req;
}
WMA_LOGA("%s: request %d is timed out for vdev_id - %d", __func__,
tgt_req->msg_type, tgt_req->vdev_id);
msg = wma_find_vdev_req(wma, tgt_req->vdev_id, tgt_req->type, true);
@ -2966,7 +2957,15 @@ void wma_vdev_resp_timer(void *data)
if (!msg) {
WMA_LOGE("%s: Failed to lookup request message - %d",
__func__, tgt_req->msg_type);
return;
}
pdev = cds_get_context(QDF_MODULE_ID_TXRX);
if (NULL == pdev) {
WMA_LOGE("%s: Failed to get pdev", __func__);
wma_cleanup_target_req_param(tgt_req);
qdf_mc_timer_stop(&tgt_req->event_timeout);
goto free_tgt_req;
}