From c6f51846013fc369e0ff94b12dcd5eea8bab7ef3 Mon Sep 17 00:00:00 2001 From: jiad Date: Tue, 1 Aug 2017 11:33:02 +0800 Subject: [PATCH] qcacld-3.0: fix tx_desc vdev null pointer derefernce In module exit context, vdev handle could be destroyed but still we need to free pending completion tx_desc. And accessing vdev handle of tx_desc will lead to null pointer derefernce. Fix is to check vdev handle against null pointer. Change-Id: Ib4e3127803f7bb0035466ec639401d7f8163598e CRs-Fixed: 2074184 --- core/dp/txrx/ol_tx_desc.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/core/dp/txrx/ol_tx_desc.c b/core/dp/txrx/ol_tx_desc.c index f5ffd5f5a22a..540c84693c1d 100644 --- a/core/dp/txrx/ol_tx_desc.c +++ b/core/dp/txrx/ol_tx_desc.c @@ -287,6 +287,13 @@ ol_tx_desc_alloc_hl(struct ol_txrx_pdev_t *pdev, static inline void ol_tx_desc_vdev_rm(struct ol_tx_desc_t *tx_desc) { + /* + * In module exit context, vdev handle could be destroyed but still + * we need to free pending completion tx_desc. + */ + if (!tx_desc || !tx_desc->vdev) + return; + qdf_atomic_dec(&tx_desc->vdev->tx_desc_count); tx_desc->vdev = NULL; }