diff options
| author | zding <zding@codeaurora.org> | 2016-10-12 14:28:34 +0800 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2016-12-29 13:23:31 -0800 |
| commit | 855d079c2b0630ca1581cf003fd72e5d1a5c6099 (patch) | |
| tree | 248807a71c30e07ed7eca92cbff1209d110d6ed2 | |
| parent | 93c5085568f746aab9deae5ddddb123227e1d232 (diff) | |
qcacld-3.0: Avoid null pointer when STAUT connect to specific AP
qcacld-2.0 to qcacld-3.0 propagation
When STAUT connected to specific AP, it will received fragment frame
with "fragno" equals to 0, and "more_frag" equals to 0, then the skb is
chained for RX thread processing. However the skb will be freed at the
end of "htt_t2h_lp_msg_process". This will trigger a null pointer
reference at "tlshim_data_rx_cb". The change is to clone this single
fragment for RX thread processing, with the same logic of handling
non-single fragment frames.
Change-Id: Ieb16cf28e04443ea13e992d04688355c39a56a52
CRs-Fixed: 1048532
| -rw-r--r-- | core/dp/txrx/ol_rx_defrag.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/core/dp/txrx/ol_rx_defrag.c b/core/dp/txrx/ol_rx_defrag.c index cb1bfed1ceed..fb9726859afd 100644 --- a/core/dp/txrx/ol_rx_defrag.c +++ b/core/dp/txrx/ol_rx_defrag.c @@ -430,8 +430,8 @@ ol_rx_reorder_store_frag(ol_txrx_pdev_handle pdev, more_frag = mac_hdr->i_fc[1] & IEEE80211_FC1_MORE_FRAG; if ((!more_frag) && (!fragno) && (!rx_reorder_array_elem->head)) { - rx_reorder_array_elem->head = frag; - rx_reorder_array_elem->tail = frag; + ol_rx_fraglist_insert(htt_pdev, &rx_reorder_array_elem->head, + &rx_reorder_array_elem->tail, frag, &all_frag_present); qdf_nbuf_set_next(frag, NULL); ol_rx_defrag(pdev, peer, tid, rx_reorder_array_elem->head); rx_reorder_array_elem->head = NULL; |