From edeff23d4f83e5d3b86a64d2dd725eb5c9f4a6e5 Mon Sep 17 00:00:00 2001 From: Jeff Johnson Date: Wed, 11 Nov 2015 17:19:42 -0800 Subject: [PATCH] qcacld-3.0: Avoid NULL skb dereference during softap TX Change "qcacld-3.0: Record data in DP Trace" introduced skb tracing functionity to the driver. In hdd_softap_hard_start_xmit() logic was added to trace the skb contents, including logic to trace the skb contents when an skb was dropped. However some of the code paths to this "drop_pkt" tracing have a NULL skb. Therefore we must bypass the dropped skb content tracing when the skb is NULL. Change-Id: I485c92647355a0f7f420f40640b697a1d3eb5fb0 CRs-Fixed: 938254 --- core/hdd/src/wlan_hdd_softap_tx_rx.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/core/hdd/src/wlan_hdd_softap_tx_rx.c b/core/hdd/src/wlan_hdd_softap_tx_rx.c index 6626ca211f83..8f98dcf84366 100644 --- a/core/hdd/src/wlan_hdd_softap_tx_rx.c +++ b/core/hdd/src/wlan_hdd_softap_tx_rx.c @@ -288,7 +288,7 @@ int hdd_softap_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) /* Check if the buffer has enough header room */ skb = skb_unshare(skb, GFP_ATOMIC); if (!skb) - goto drop_pkt; + goto drop_pkt_accounting; if (skb_headroom(skb) < dev->hard_header_len) { struct sk_buff *tmp; @@ -296,7 +296,7 @@ int hdd_softap_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) skb = skb_realloc_headroom(tmp, dev->hard_header_len); dev_kfree_skb(tmp); if (!skb) - goto drop_pkt; + goto drop_pkt_accounting; } #if defined (IPA_OFFLOAD) } @@ -357,10 +357,11 @@ drop_pkt: DPTRACE(cdf_dp_trace(skb, CDF_DP_TRACE_DROP_PACKET_RECORD, (uint8_t *)&skb->data[CDF_DP_TRACE_RECORD_SIZE], (cdf_nbuf_len(skb)-CDF_DP_TRACE_RECORD_SIZE))); + kfree_skb(skb); +drop_pkt_accounting: ++pAdapter->stats.tx_dropped; ++pAdapter->hdd_stats.hddTxRxStats.txXmitDropped; - kfree_skb(skb); return NETDEV_TX_OK; }