From 855d079c2b0630ca1581cf003fd72e5d1a5c6099 Mon Sep 17 00:00:00 2001 From: zding Date: Wed, 12 Oct 2016 14:28:34 +0800 Subject: qcacld-3.0: Avoid null pointer when STAUT connect to specific AP qcacld-2.0 to qcacld-3.0 propagation When STAUT connected to specific AP, it will received fragment frame with "fragno" equals to 0, and "more_frag" equals to 0, then the skb is chained for RX thread processing. However the skb will be freed at the end of "htt_t2h_lp_msg_process". This will trigger a null pointer reference at "tlshim_data_rx_cb". The change is to clone this single fragment for RX thread processing, with the same logic of handling non-single fragment frames. Change-Id: Ieb16cf28e04443ea13e992d04688355c39a56a52 CRs-Fixed: 1048532 --- core/dp/txrx/ol_rx_defrag.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/dp/txrx/ol_rx_defrag.c b/core/dp/txrx/ol_rx_defrag.c index cb1bfed1ceed..fb9726859afd 100644 --- a/core/dp/txrx/ol_rx_defrag.c +++ b/core/dp/txrx/ol_rx_defrag.c @@ -430,8 +430,8 @@ ol_rx_reorder_store_frag(ol_txrx_pdev_handle pdev, more_frag = mac_hdr->i_fc[1] & IEEE80211_FC1_MORE_FRAG; if ((!more_frag) && (!fragno) && (!rx_reorder_array_elem->head)) { - rx_reorder_array_elem->head = frag; - rx_reorder_array_elem->tail = frag; + ol_rx_fraglist_insert(htt_pdev, &rx_reorder_array_elem->head, + &rx_reorder_array_elem->tail, frag, &all_frag_present); qdf_nbuf_set_next(frag, NULL); ol_rx_defrag(pdev, peer, tid, rx_reorder_array_elem->head); rx_reorder_array_elem->head = NULL; -- cgit v1.2.3