diff options
| author | Govind Singh <govinds@codeaurora.org> | 2017-08-17 15:41:05 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-08-21 01:05:05 -0700 |
| commit | f0406a01365bd4fc522461ba4f1019438c16f29c (patch) | |
| tree | 8c8f8aa9f1ace0b9758a39713e3173517f0e6478 | |
| parent | a391b8e101ef6329aada74fabd2ac0d1ab274658 (diff) | |
qcacld-3.0: Exit gracefully if netbuf pop fails from rx hash table
Recovery is triggered if rx hash table look up fails due to invalid
physical address. Since netbuf is not found in this case and null
netbuf is de-referenced after recovery is completed and this leads
to null pointer exception.
Exit gracefully if netbuf pop fails from rx hash table.
Change-Id: I66b3d1cf9aa05da235212923a551e58d86153e55
CRs-Fixed: 2094521
| -rw-r--r-- | core/dp/txrx/ol_rx_defrag.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/core/dp/txrx/ol_rx_defrag.c b/core/dp/txrx/ol_rx_defrag.c index 9fee005f462e..0e1a38420074 100644 --- a/core/dp/txrx/ol_rx_defrag.c +++ b/core/dp/txrx/ol_rx_defrag.c @@ -332,6 +332,7 @@ ol_rx_frag_indication_handler(ol_txrx_pdev_handle pdev, void *rx_mpdu_desc; uint8_t pktlog_bit; uint32_t msdu_count = 0; + int ret; htt_pdev = pdev->htt_pdev; peer = ol_txrx_peer_find_by_id(pdev, peer_id); @@ -350,9 +351,14 @@ ol_rx_frag_indication_handler(ol_txrx_pdev_handle pdev, } pktlog_bit = (htt_rx_amsdu_rx_in_order_get_pktlog(rx_frag_ind_msg) == 0x01); + ret = htt_rx_frag_pop(htt_pdev, rx_frag_ind_msg, &head_msdu, + &tail_msdu, &msdu_count); + /* Return if msdu pop fails from rx hash table, as recovery + * is triggered and we exit gracefully. + */ + if (!ret) + return; if (peer) { - htt_rx_frag_pop(htt_pdev, rx_frag_ind_msg, &head_msdu, - &tail_msdu, &msdu_count); qdf_assert(head_msdu == tail_msdu); if (ol_cfg_is_full_reorder_offload(pdev->ctrl_pdev)) { rx_mpdu_desc = @@ -369,8 +375,6 @@ ol_rx_frag_indication_handler(ol_txrx_pdev_handle pdev, ol_rx_reorder_store_frag(pdev, peer, tid, seq_num, head_msdu); } else { /* invalid frame - discard it */ - htt_rx_frag_pop(htt_pdev, rx_frag_ind_msg, &head_msdu, - &tail_msdu, &msdu_count); if (ol_cfg_is_full_reorder_offload(pdev->ctrl_pdev)) htt_rx_msdu_desc_retrieve(htt_pdev, head_msdu); else |