diff options
| author | bings <bings@codeaurora.org> | 2017-10-23 16:32:30 +0800 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-10-28 16:23:55 -0700 |
| commit | 9e58ac92bab0975382dee6be19ede6daf8ac2aa4 (patch) | |
| tree | 7c5c300f2ffec9d8fccf559dfb871bb65610c7c5 | |
| parent | 1fac7787a708686e11397f31abc60237c1ec775b (diff) | |
qcacld-3.0: Fix race condition of radar pulse handling and dfs ch config
For SAP+SAP mode, when the second SAP starts, wma_vdev_start is called
which calls dfs_radar_enable. In dfs_radar_enable, dfs->dfs_b5radars is
freed. If at the same time radr pulse is received for the first SAP,
which then accesses freed buffer dfs->dfs_b5radars, crash happens.
When the second SAP doing dfs_radar_enable, none radar pulses should be
processed.
Change-Id: Ibf1805b0dbd27fbdf36c37450bdb95626195fb81
CRs-Fixed: 2130697
| -rw-r--r-- | core/sap/dfs/inc/dfs_interface.h | 10 | ||||
| -rw-r--r-- | core/sap/dfs/src/dfs.c | 25 | ||||
| -rw-r--r-- | core/wma/src/wma_features.c | 5 |
3 files changed, 39 insertions, 1 deletions
diff --git a/core/sap/dfs/inc/dfs_interface.h b/core/sap/dfs/inc/dfs_interface.h index e0bbf90bf285..92207a8d246c 100644 --- a/core/sap/dfs/inc/dfs_interface.h +++ b/core/sap/dfs/inc/dfs_interface.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved. + * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved. * * Previously licensed under the ISC license by Qualcomm Atheros, Inc. * @@ -75,6 +75,14 @@ void dfs_detach(struct ieee80211com *ic); int dfs_radar_enable(struct ieee80211com *ic, struct ath_dfs_radar_tab_info *ri); int dfs_radar_disable(struct ieee80211com *ic); + +/** + * is_dfs_radar_enable() - Is dfs radar enable. + * @ic: ieee80211com ptr + * + * Return: 1 for radar enable + */ +bool is_dfs_radar_enable(struct ieee80211com *ic); extern void dfs_process_phyerr(struct ieee80211com *ic, void *buf, uint16_t datalen, uint8_t rssi, uint8_t ext_rssi, uint32_t rs_tstamp, uint64_t fulltsf, diff --git a/core/sap/dfs/src/dfs.c b/core/sap/dfs/src/dfs.c index ad911f476b06..b0db7881d34f 100644 --- a/core/sap/dfs/src/dfs.c +++ b/core/sap/dfs/src/dfs.c @@ -541,6 +541,21 @@ void dfs_detach(struct ieee80211com *ic) ic->ic_dfs = NULL; } + +#ifdef ATH_ENABLE_AR +bool is_dfs_radar_enable(struct ieee80211com *ic) +{ + struct ath_dfs *dfs = (struct ath_dfs *)ic->ic_dfs; + return (dfs->dfs_proc_phyerr & DFS_RADAR_EN) && + (dfs->dfs_proc_phyerr & DFS_AR_EN); +} +#else +bool is_dfs_radar_enable(struct ieee80211com *ic) +{ + struct ath_dfs *dfs = (struct ath_dfs *)ic->ic_dfs; + return (dfs->dfs_proc_phyerr & DFS_RADAR_EN); +} +#endif /* * This is called each time a channel change occurs, to (potentially) enable * the radar code. @@ -579,6 +594,14 @@ int dfs_radar_enable(struct ieee80211com *ic, return -EIO; } + + dfs_radar_disable(ic); + /* + * set ath_radar_tasksched as 1 to prevent radar task scheduled. + * This is fake value, and it is set as 0 after dfs buffer reinit. + */ + dfs->ath_radar_tasksched = 1; + qdf_timer_sync_cancel(&dfs->ath_dfs_task_timer); ic->ic_dfs_disable(ic); /* @@ -587,6 +610,8 @@ int dfs_radar_enable(struct ieee80211com *ic, */ radar_filters_init_status = dfs_init_radar_filters(ic, radar_info); + dfs->ath_radar_tasksched = 0; + /* * dfs_init_radar_filters() returns 1 on failure and * 0 on success. diff --git a/core/wma/src/wma_features.c b/core/wma/src/wma_features.c index fed93029fdbd..14686d41a4ea 100644 --- a/core/wma/src/wma_features.c +++ b/core/wma/src/wma_features.c @@ -2125,6 +2125,11 @@ static QDF_STATUS dfs_phyerr_offload_event_handler(void *handle, WMA_LOGE("%s: dfs is NULL ", __func__); return QDF_STATUS_E_FAILURE; } + + if (!is_dfs_radar_enable(ic)) { + WMA_LOGD("%s: DFS_AR_EN not enabled", __func__); + return QDF_STATUS_E_FAILURE; + } /* * This parameter holds the number * of phyerror interrupts to the host |