From bdd5fcef82247e627d54fffc092e3c1d26e65365 Mon Sep 17 00:00:00 2001 From: Liangwei Dong Date: Tue, 3 Mar 2020 17:05:03 +0800 Subject: [PATCH] qcacmn: Clear lock->lock.dev to NULL after wake lock destroyed In kernel 5.4, Wake lock API wakeup_source_register requires "struct device *" parameter, and it can be NULL value. If it is NULL, the wakeup_source_register will create a "device" node and return it by wakeup_source struct. In qcacld driver, the qdf_wake_lock_create will save the "wakeup_source" to cld's private struct qdf_wake_lock->lock. When the cld driver destroy os wake lock by wakeup_source_unregister, "dev" will also be invalid in kernel, we need to clear the "dev" field in local copy of wakeup_source in qdf_wake_lock->lock. This will fix the potential reuse of qdf_wake_lock->lock.dev after it has been destroyed. Change-Id: I1de6e95c64b35929bef8be2cdeeb86422bc38515 CRs-Fixed: 2634032 --- qdf/linux/src/qdf_lock.c | 1 + 1 file changed, 1 insertion(+) diff --git a/qdf/linux/src/qdf_lock.c b/qdf/linux/src/qdf_lock.c index 6dd744f20679..a567f84b1b47 100644 --- a/qdf/linux/src/qdf_lock.c +++ b/qdf/linux/src/qdf_lock.c @@ -268,6 +268,7 @@ qdf_export_symbol(qdf_wake_lock_name); #if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 0)) QDF_STATUS qdf_wake_lock_create(qdf_wake_lock_t *lock, const char *name) { + qdf_mem_zero(lock, sizeof(*lock)); lock->priv = wakeup_source_register(lock->lock.dev, name); if (!(lock->priv)) { QDF_BUG(0);