diff options
| author | Poddar, Siddarth <siddpodd@codeaurora.org> | 2017-02-09 15:42:10 +0530 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2017-02-13 14:27:22 -0800 |
| commit | 334b411929315e7ba777d210e7ddf1161be90b0f (patch) | |
| tree | 0fd4456fe45482eec7068ec3af3cf04ce925dde0 | |
| parent | 91ab88bd7ab183d09e4ef69317b4f2c658d85cd7 (diff) | |
qcacld-3.0: De-reference tso list element after NULL check
De-reference tso list element in ol_tso_seg_list_init and
ol_tso_num_seg_list_init functions after NULL check.
Change-Id: I89581e5c57275804d967ab734d6bcc714b6745e4
CRs-Fixed: 2004503
| -rw-r--r-- | core/dp/txrx/ol_tx.c | 65 |
1 files changed, 56 insertions, 9 deletions
diff --git a/core/dp/txrx/ol_tx.c b/core/dp/txrx/ol_tx.c index 005a33707c8f..ad21441a7e4b 100644 --- a/core/dp/txrx/ol_tx.c +++ b/core/dp/txrx/ol_tx.c @@ -2002,12 +2002,21 @@ qdf_nbuf_t ol_tx_reinject(struct ol_txrx_vdev_t *vdev, */ void ol_tso_seg_list_init(struct ol_txrx_pdev_t *pdev, uint32_t num_seg) { - int i; + int i = 0; struct qdf_tso_seg_elem_t *c_element; + /* Host should not allocate any c_element. */ + if (num_seg <= 0) { + TXRX_PRINT(TXRX_PRINT_LEVEL_ERR, + "%s: ERROR: Pool size passed is 0", + __func__); + QDF_BUG(0); + pdev->tso_seg_pool.pool_size = i; + qdf_spinlock_create(&pdev->tso_seg_pool.tso_mutex); + return; + } + c_element = qdf_mem_malloc(sizeof(struct qdf_tso_seg_elem_t)); - c_element->on_freelist = 1; - c_element->cookie = TSO_SEG_MAGIC_COOKIE; pdev->tso_seg_pool.freelist = c_element; for (i = 0; i < (num_seg - 1); i++) { if (qdf_unlikely(!c_element)) { @@ -2020,13 +2029,28 @@ void ol_tso_seg_list_init(struct ol_txrx_pdev_t *pdev, uint32_t num_seg) return; } /* set the freelist bit and magic cookie*/ + c_element->on_freelist = 1; + c_element->cookie = TSO_SEG_MAGIC_COOKIE; c_element->next = qdf_mem_malloc(sizeof(struct qdf_tso_seg_elem_t)); c_element = c_element->next; - c_element->on_freelist = 1; - c_element->cookie = TSO_SEG_MAGIC_COOKIE; - c_element->next = NULL; } + /* + * NULL check for the last c_element of the list or + * first c_element if num_seg is equal to 1. + */ + if (qdf_unlikely(!c_element)) { + TXRX_PRINT(TXRX_PRINT_LEVEL_ERR, + "%s: ERROR: c_element NULL for seg %d", + __func__, i); + QDF_BUG(0); + pdev->tso_seg_pool.pool_size = i; + qdf_spinlock_create(&pdev->tso_seg_pool.tso_mutex); + return; + } + c_element->on_freelist = 1; + c_element->cookie = TSO_SEG_MAGIC_COOKIE; + c_element->next = NULL; pdev->tso_seg_pool.pool_size = num_seg; qdf_spinlock_create(&pdev->tso_seg_pool.tso_mutex); } @@ -2088,9 +2112,20 @@ void ol_tso_seg_list_deinit(struct ol_txrx_pdev_t *pdev) */ void ol_tso_num_seg_list_init(struct ol_txrx_pdev_t *pdev, uint32_t num_seg) { - int i; + int i = 0; struct qdf_tso_num_seg_elem_t *c_element; + /* Host should not allocate any c_element. */ + if (num_seg <= 0) { + TXRX_PRINT(TXRX_PRINT_LEVEL_ERR, + "%s: ERROR: Pool size passed is 0", + __func__); + QDF_BUG(0); + pdev->tso_num_seg_pool.num_seg_pool_size = i; + qdf_spinlock_create(&pdev->tso_num_seg_pool.tso_num_seg_mutex); + return; + } + c_element = qdf_mem_malloc(sizeof(struct qdf_tso_num_seg_elem_t)); pdev->tso_num_seg_pool.freelist = c_element; for (i = 0; i < (num_seg - 1); i++) { @@ -2104,12 +2139,24 @@ void ol_tso_num_seg_list_init(struct ol_txrx_pdev_t *pdev, uint32_t num_seg) tso_num_seg_mutex); return; } - c_element->next = qdf_mem_malloc(sizeof(struct qdf_tso_num_seg_elem_t)); c_element = c_element->next; - c_element->next = NULL; } + /* + * NULL check for the last c_element of the list or + * first c_element if num_seg is equal to 1. + */ + if (qdf_unlikely(!c_element)) { + TXRX_PRINT(TXRX_PRINT_LEVEL_ERR, + "%s: ERROR: c_element NULL for num of seg %d", + __func__, i); + QDF_BUG(0); + pdev->tso_num_seg_pool.num_seg_pool_size = i; + qdf_spinlock_create(&pdev->tso_num_seg_pool.tso_num_seg_mutex); + return; + } + c_element->next = NULL; pdev->tso_num_seg_pool.num_seg_pool_size = num_seg; qdf_spinlock_create(&pdev->tso_num_seg_pool.tso_num_seg_mutex); } |