diff options
| author | Yun Park <yunp@codeaurora.org> | 2018-01-12 15:00:12 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-01-17 09:02:06 -0800 |
| commit | e7cc594fd61aca2d47238ab1dd90636a86bb76d1 (patch) | |
| tree | 2639ea121ecc5acd3a26bf425d97eb6109cef924 | |
| parent | eb6337f194e11b6e490b87d62059a528e36cbdce (diff) | |
qcacld-3.0: Protect peer info when getting vdev by sta_id
When getting vdev by sta_id, peer could be deleted after retrieved,
so garbage vdev is returned.
To protect peer info, increase ref_cnt and delete peer when the ref
count is 0.
Change-Id: I850d38166d7c16d7f5e580baf3e0d17db22583f8
CRs-Fixed: 2171619
| -rw-r--r-- | core/dp/txrx/ol_txrx.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/core/dp/txrx/ol_txrx.c b/core/dp/txrx/ol_txrx.c index de42bfdf9025..c114b62305b0 100644 --- a/core/dp/txrx/ol_txrx.c +++ b/core/dp/txrx/ol_txrx.c @@ -104,6 +104,11 @@ #define OL_TXRX_PEER_DEC_REF_CNT_SILENT(peer) \ qdf_atomic_dec(&peer->ref_cnt) +ol_txrx_peer_handle +ol_txrx_peer_find_by_local_id_inc_ref(struct ol_txrx_pdev_t *pdev, + uint8_t local_peer_id); +static void ol_txrx_peer_dec_ref_cnt(struct ol_txrx_peer_t *peer); + #if defined(CONFIG_HL_SUPPORT) && defined(FEATURE_WLAN_TDLS) /** @@ -323,6 +328,7 @@ void *ol_txrx_get_vdev_by_sta_id(uint8_t sta_id) { struct ol_txrx_peer_t *peer = NULL; ol_txrx_pdev_handle pdev = NULL; + ol_txrx_vdev_handle vdev; if (sta_id >= WLAN_MAX_STA_COUNT) { QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_INFO_HIGH, @@ -337,14 +343,17 @@ void *ol_txrx_get_vdev_by_sta_id(uint8_t sta_id) return NULL; } - peer = ol_txrx_peer_find_by_local_id(pdev, sta_id); + peer = ol_txrx_peer_find_by_local_id_inc_ref(pdev, sta_id); if (!peer) { QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_INFO_HIGH, "PEER [%d] not found", sta_id); return NULL; } - return peer->vdev; + vdev = peer->vdev; + ol_txrx_peer_dec_ref_cnt(peer); + + return vdev; } /** |