diff options
| author | wadesong <wadesong@codeaurora.org> | 2017-08-11 14:15:05 +0800 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-08-17 00:08:51 -0700 |
| commit | 51e28fdb76b0fee71eded82bf7e3409e56a39973 (patch) | |
| tree | b7fbfc5757d24fe3262d7e9172e6ba5f62acc0cc | |
| parent | e501262cffec4294770195197333939997466e03 (diff) | |
qcacld-3.0: Protect tx descritpor states during allocation
Tx descriptors' state info, such as vdev pointer, vdev ID and
ref_cnt, are protected by a spin lock during freeing, but not
protected by the same lock during allocation. Correct the
discrepancies to avoid a NULL pointer dereference issue
Change-Id: Ie0fb634a893a8d33888f7f1f6685a4fb7219e308
CRs-Fixed: 2091379
| -rw-r--r-- | core/dp/txrx/ol_tx_desc.c | 15 |
1 files changed, 7 insertions, 8 deletions
diff --git a/core/dp/txrx/ol_tx_desc.c b/core/dp/txrx/ol_tx_desc.c index 24b2f7127587..af869f24eb0d 100644 --- a/core/dp/txrx/ol_tx_desc.c +++ b/core/dp/txrx/ol_tx_desc.c @@ -144,19 +144,18 @@ struct ol_tx_desc_t *ol_tx_desc_alloc(struct ol_txrx_pdev_t *pdev, qdf_spin_lock_bh(&pdev->tx_mutex); if (pdev->tx_desc.freelist) { tx_desc = ol_tx_get_desc_global_pool(pdev); + if (!tx_desc) { + qdf_spin_unlock_bh(&pdev->tx_mutex); + return NULL; + } ol_tx_desc_dup_detect_set(pdev, tx_desc); ol_tx_desc_sanity_checks(pdev, tx_desc); ol_tx_desc_compute_delay(tx_desc); + ol_tx_desc_vdev_update(tx_desc, vdev); + ol_tx_desc_count_inc(vdev); + qdf_atomic_inc(&tx_desc->ref_cnt); } qdf_spin_unlock_bh(&pdev->tx_mutex); - - if (!tx_desc) - return NULL; - - ol_tx_desc_vdev_update(tx_desc, vdev); - ol_tx_desc_count_inc(vdev); - qdf_atomic_inc(&tx_desc->ref_cnt); - return tx_desc; } |