A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-31 12:10:52 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Abort scan cancel upon failure to get vdev ref

Browse source 
ucfg_scan_cancel currently grabs a vdev reference unconditionally. This
opens the possibility of operating on a destroyed vdev. Instead, try to
get a vdev reference, and abort the scan cancel operation if a reference
cannot be obtained.

Change-Id: I6380775c6cd09920ad70feed0ec67e4c85ba890d
CRs-Fixed: 2149645
This commit is contained in:
Dustin Brown 2017-11-27 15:29:36 -08:00 • committed by snandini
commit c2fa95196d
1 changed files with 14 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

21
umac/scan/dispatcher/src/wlan_scan_ucfg_api.c
View file

@ -588,11 +588,11 @@ ucfg_scan_cancel(struct scan_cancel_request *req)
req->cancel_req.requester, req->cancel_req.scan_id,
req->cancel_req.vdev_id, req->cancel_req.req_type);
/* Get vdev reference unconditionally.
* Reference will be released once scan cancel is
* posted to FW.
*/
wlan_objmgr_vdev_get_ref(req->vdev, WLAN_SCAN_ID);
status = wlan_objmgr_vdev_try_get_ref(req->vdev, WLAN_SCAN_ID);
if (QDF_IS_STATUS_ERROR(status)) {
scm_info("Failed to get vdev ref; status:%d", status);
goto req_free;
}
msg.bodyptr = req;
msg.callback = scm_scan_cancel_req;
@ -601,10 +601,17 @@ ucfg_scan_cancel(struct scan_cancel_request *req)
status = scheduler_post_msg(QDF_MODULE_ID_OS_IF, &msg);
if (QDF_IS_STATUS_ERROR(status)) {
scm_err("failed to post to QDF_MODULE_ID_OS_IF");
wlan_objmgr_vdev_release_ref(req->vdev, WLAN_SCAN_ID);
qdf_mem_free(req);
goto vdev_put;
}
return QDF_STATUS_SUCCESS;
vdev_put:
wlan_objmgr_vdev_release_ref(req->vdev, WLAN_SCAN_ID);
req_free:
qdf_mem_free(req);
return status;
}