From c7ef8f098292b1965cee33761ca1fb67d2f017b7 Mon Sep 17 00:00:00 2001 From: Krunal Soni Date: Wed, 8 Jun 2016 11:48:08 -0700 Subject: [PATCH] qcacld-3.0: Fix cds_complete_action API from going in infinite loop In cds_complete_action API when cds_get_connection_for_vdev_id is called to get connection index, it may return MAX_NUMBER_OF_CONC_CONNECTION to notify that no such connection found. up-on receiving this max number with current bug, the cds_complete_action API goes in to infinite loop which causes driver to crash at the end. Fix this bug by updating API's loop correctly. Change-Id: Iaf722afb4a450c66f976ad1a3ae4b697657216ef CRs-Fixed: 1034888 --- core/cds/src/cds_concurrency.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/core/cds/src/cds_concurrency.c b/core/cds/src/cds_concurrency.c index 69e86b21730f..45d568ca8999 100644 --- a/core/cds/src/cds_concurrency.c +++ b/core/cds/src/cds_concurrency.c @@ -6240,7 +6240,7 @@ QDF_STATUS cds_complete_action(uint8_t new_nss, uint8_t next_action, uint32_t session_id) { QDF_STATUS status = QDF_STATUS_E_FAILURE; - uint32_t index = 0, count = 0; + uint32_t index, count; uint32_t list[MAX_NUMBER_OF_CONC_CONNECTIONS]; uint32_t conn_index = 0; hdd_context_t *hdd_ctx; @@ -6263,7 +6263,7 @@ QDF_STATUS cds_complete_action(uint8_t new_nss, uint8_t next_action, */ count = cds_mode_specific_connection_count( CDS_P2P_GO_MODE, list); - while (index < count) { + for (index = 0; index < count; index++) { conn_index = cds_get_connection_for_vdev_id( conc_connection_list[list[index]].vdev_id); if (MAX_NUMBER_OF_CONC_CONNECTIONS == conn_index) { @@ -6283,13 +6283,18 @@ QDF_STATUS cds_complete_action(uint8_t new_nss, uint8_t next_action, conc_connection_list[list[index]].vdev_id); } } - index++; } - index = 0; count = cds_mode_specific_connection_count( CDS_SAP_MODE, list); - while (index < count) { + for (index = 0; index < count; index++) { + conn_index = cds_get_connection_for_vdev_id( + conc_connection_list[list[index]].vdev_id); + if (MAX_NUMBER_OF_CONC_CONNECTIONS == conn_index) { + cds_err("connection not found for vdev %d", + conc_connection_list[list[index]].vdev_id); + continue; + } if (1 == conc_connection_list[list[index]].original_nss) { status = sme_nss_update_request(hdd_ctx->hHal, conc_connection_list @@ -6301,7 +6306,6 @@ QDF_STATUS cds_complete_action(uint8_t new_nss, uint8_t next_action, conc_connection_list[list[index]].vdev_id); } } - index++; } if (!QDF_IS_STATUS_SUCCESS(status)) status = cds_next_actions(session_id,