android_kernel_motorola_sm6375/components/tdls
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Srinivas Dasari 3b51b87b4e qcacld-3.0: Fetch vdev from psoc in TDLS handlers
Currently, if the TDLS timer expires while the scheduler thread
is processing something(e.g., station vdev destroy), the handler
would be in wait queue and it gets called once the scheduler
thread is done with its current task(i.e., vdev deletion).
TDLS handler tries to use the vdev even it has just got freed,
which leads to use-after-free.
This happens because of the below,
1. vdev destroy notification has no knowledge of the TDLS timer
   expiry as timer_stop is used to stop the timer.
2. vdev is passed to TDLS handler as part of registration.

Fix:
1. Use timer_stop_sync in vdev_destroy_notification to make
   sure the handler is posted to scheduler thread if the timer
   had expired.
2. Get the vdev in handler from psoc instead of passing it to
   the timer handler. This can make sure the vdev is referred
   only if it exists.

Change-Id: I186fd0d44b2364ebb375a8445dd1239368543e7b
CRs-Fixed: 2792020
2020-10-13 05:17:01 -07:00
..
core/src qcacld-3.0: Fetch vdev from psoc in TDLS handlers 2020-10-13 05:17:01 -07:00
dispatcher qcacld-3.0: components: Remove logs for qdf_mem_malloc() checks 2020-09-25 12:59:42 -07:00