From 51e28fdb76b0fee71eded82bf7e3409e56a39973 Mon Sep 17 00:00:00 2001 From: wadesong Date: Fri, 11 Aug 2017 14:15:05 +0800 Subject: qcacld-3.0: Protect tx descritpor states during allocation Tx descriptors' state info, such as vdev pointer, vdev ID and ref_cnt, are protected by a spin lock during freeing, but not protected by the same lock during allocation. Correct the discrepancies to avoid a NULL pointer dereference issue Change-Id: Ie0fb634a893a8d33888f7f1f6685a4fb7219e308 CRs-Fixed: 2091379 --- core/dp/txrx/ol_tx_desc.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/core/dp/txrx/ol_tx_desc.c b/core/dp/txrx/ol_tx_desc.c index 24b2f7127587..af869f24eb0d 100644 --- a/core/dp/txrx/ol_tx_desc.c +++ b/core/dp/txrx/ol_tx_desc.c @@ -144,19 +144,18 @@ struct ol_tx_desc_t *ol_tx_desc_alloc(struct ol_txrx_pdev_t *pdev, qdf_spin_lock_bh(&pdev->tx_mutex); if (pdev->tx_desc.freelist) { tx_desc = ol_tx_get_desc_global_pool(pdev); + if (!tx_desc) { + qdf_spin_unlock_bh(&pdev->tx_mutex); + return NULL; + } ol_tx_desc_dup_detect_set(pdev, tx_desc); ol_tx_desc_sanity_checks(pdev, tx_desc); ol_tx_desc_compute_delay(tx_desc); + ol_tx_desc_vdev_update(tx_desc, vdev); + ol_tx_desc_count_inc(vdev); + qdf_atomic_inc(&tx_desc->ref_cnt); } qdf_spin_unlock_bh(&pdev->tx_mutex); - - if (!tx_desc) - return NULL; - - ol_tx_desc_vdev_update(tx_desc, vdev); - ol_tx_desc_count_inc(vdev); - qdf_atomic_inc(&tx_desc->ref_cnt); - return tx_desc; } -- cgit v1.2.3