mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-20 11:40:15 -04:00
| Filename | Latest commit message | Latest commit date |
|---|---|---|
3b51b87b4e
Currently, if the TDLS timer expires while the scheduler thread is processing something(e.g., station vdev destroy), the handler would be in wait queue and it gets called once the scheduler thread is done with its current task(i.e., vdev deletion). TDLS handler tries to use the vdev even it has just got freed, which leads to use-after-free. This happens because of the below, 1. vdev destroy notification has no knowledge of the TDLS timer expiry as timer_stop is used to stop the timer. 2. vdev is passed to TDLS handler as part of registration. Fix: 1. Use timer_stop_sync in vdev_destroy_notification to make sure the handler is posted to scheduler thread if the timer had expired. 2. Get the vdev in handler from psoc instead of passing it to the timer handler. This can make sure the vdev is referred only if it exists. Change-Id: I186fd0d44b2364ebb375a8445dd1239368543e7b CRs-Fixed: 2792020 |
||
| .. | ||
| action_oui | ||
| blacklist_mgr | ||
| cfg | ||
| cmn_services | ||
| cp_stats/dispatcher | ||
| disa | ||
| dsc | ||
| ftm_time_sync | ||
| fw_offload | ||
| interop_issues_ap | ||
| ipa | ||
| mlme | ||
| nan | ||
| ocb | ||
| p2p | ||
| pkt_capture | ||
| pmo | ||
| target_if | ||
| tdls | ||
| umac/mlme | ||
| wmi | ||