diff options
| author | Deepak Dhamdhere <ddhamdhe@codeaurora.org> | 2017-03-30 17:51:53 -0700 |
|---|---|---|
| committer | Sandeep Puligilla <spuligil@codeaurora.org> | 2017-04-04 11:05:27 -0700 |
| commit | a9c2b76a3fd4d53b99bdddff63337865840c00a3 (patch) | |
| tree | 1a7b7c81247e793a28e3f9e81c62be2dbb74163b | |
| parent | e6f61634bf7cb356df2bf625dc05686dbf0e85ba (diff) | |
qcacld-3.0: Use qdf_timer_sync_cancel to stop peer_unmap_timer
Peer may get deleted between the time peer_unmap_timer fires and
the handler gets executed in mc thread context, causing memory
access error. Use qdf_timer_sync_cancel() to wait for the handler
to finish its job before freeing the peer object.
CRs-Fixed: 2026393
Change-Id: Ie60b5c300be529d529f7e836adc0e3be917fe2e8
| -rw-r--r-- | core/dp/txrx/ol_txrx.c | 16 | ||||
| -rw-r--r-- | core/dp/txrx/ol_txrx_types.h | 2 |
2 files changed, 9 insertions, 9 deletions
diff --git a/core/dp/txrx/ol_txrx.c b/core/dp/txrx/ol_txrx.c index 58a4bb7e438b..2b8ce31091e4 100644 --- a/core/dp/txrx/ol_txrx.c +++ b/core/dp/txrx/ol_txrx.c @@ -2470,8 +2470,8 @@ ol_txrx_peer_attach(ol_txrx_vdev_handle vdev, uint8_t *peer_mac_addr) OL_TXRX_PEER_INC_REF_CNT(peer); peer->valid = 1; - qdf_mc_timer_init(&peer->peer_unmap_timer, QDF_TIMER_TYPE_SW, - peer_unmap_timer_handler, peer); + qdf_timer_init(pdev->osdev, &peer->peer_unmap_timer, + peer_unmap_timer_handler, peer, QDF_TIMER_TYPE_SW); ol_txrx_peer_find_hash_add(pdev, peer); @@ -3126,7 +3126,8 @@ int ol_txrx_peer_unref_delete(ol_txrx_peer_handle peer, vdev->wait_on_peer_id = OL_TXRX_INVALID_LOCAL_PEER_ID; } - qdf_mc_timer_destroy(&peer->peer_unmap_timer); + qdf_timer_sync_cancel(&peer->peer_unmap_timer); + qdf_timer_free(&peer->peer_unmap_timer); /* check whether the parent vdev has no peers left */ if (TAILQ_EMPTY(&vdev->peer_list)) { @@ -3346,11 +3347,10 @@ void ol_txrx_peer_detach(ol_txrx_peer_handle peer) * Create a timer to track unmap events when the sta peer gets deleted. */ if (vdev->opmode == wlan_op_mode_sta) { - qdf_mc_timer_start(&peer->peer_unmap_timer, - OL_TXRX_PEER_UNMAP_TIMEOUT); - ol_txrx_info( - "%s: started peer_unmap_timer for peer %p", - __func__, peer); + qdf_timer_start(&peer->peer_unmap_timer, + OL_TXRX_PEER_UNMAP_TIMEOUT); + ol_txrx_info("%s: started peer_unmap_timer for peer %p", + __func__, peer); } /* diff --git a/core/dp/txrx/ol_txrx_types.h b/core/dp/txrx/ol_txrx_types.h index f9c1ab328a51..db7fd194b8f5 100644 --- a/core/dp/txrx/ol_txrx_types.h +++ b/core/dp/txrx/ol_txrx_types.h @@ -1243,7 +1243,7 @@ struct ol_txrx_peer_t { qdf_time_t last_disassoc_rcvd; qdf_time_t last_deauth_rcvd; qdf_atomic_t fw_create_pending; - qdf_mc_timer_t peer_unmap_timer; + qdf_timer_t peer_unmap_timer; }; enum ol_rx_err_type { |