From e25710a25cee17938aaa82233cee85ba45579149 Mon Sep 17 00:00:00 2001 From: Sourav Mohapatra Date: Mon, 29 Jun 2020 12:07:56 +0530 Subject: [PATCH] qcacld-3.0: Relocate fetching of hdd_ctx to avoid stale pointer In the function hdd_driver_unload, the hdd_ctx is fetched at the beginning before the dsc_wait_for_trans. In the scenario where this wait_for_trans is active and in the other thread (for example when wlan_pld_remove and rmmod run in parallel) the hdd_ctx is invalidated, the local copy of the pointer becomes stale. Accessing this stale pointer leads to page fault. Do not fetch the hdd_ctx before waiting for dsc trans. Rather fetch it just before where it is actually used. Change-Id: Ia5524c7a2af8ff2e976a6f1d3e87f2f374fdc371 CRs-Fixed: 2720714 --- core/hdd/src/wlan_hdd_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/core/hdd/src/wlan_hdd_main.c b/core/hdd/src/wlan_hdd_main.c index 7614d8c2a385..7c74e68a216e 100644 --- a/core/hdd/src/wlan_hdd_main.c +++ b/core/hdd/src/wlan_hdd_main.c @@ -15929,7 +15929,7 @@ exit: static void hdd_driver_unload(void) { struct osif_driver_sync *driver_sync; - struct hdd_context *hdd_ctx = cds_get_context(QDF_MODULE_ID_HDD); + struct hdd_context *hdd_ctx; QDF_STATUS status; void *hif_ctx; @@ -15962,6 +15962,7 @@ static void hdd_driver_unload(void) cds_set_driver_loaded(false); cds_set_unload_in_progress(true); + hdd_ctx = cds_get_context(QDF_MODULE_ID_HDD); if (hdd_ctx) { hdd_psoc_idle_timer_stop(hdd_ctx); /*