From a9c2b76a3fd4d53b99bdddff63337865840c00a3 Mon Sep 17 00:00:00 2001 From: Deepak Dhamdhere Date: Thu, 30 Mar 2017 17:51:53 -0700 Subject: qcacld-3.0: Use qdf_timer_sync_cancel to stop peer_unmap_timer Peer may get deleted between the time peer_unmap_timer fires and the handler gets executed in mc thread context, causing memory access error. Use qdf_timer_sync_cancel() to wait for the handler to finish its job before freeing the peer object. CRs-Fixed: 2026393 Change-Id: Ie60b5c300be529d529f7e836adc0e3be917fe2e8 --- core/dp/txrx/ol_txrx.c | 16 ++++++++-------- core/dp/txrx/ol_txrx_types.h | 2 +- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/core/dp/txrx/ol_txrx.c b/core/dp/txrx/ol_txrx.c index 58a4bb7e438b..2b8ce31091e4 100644 --- a/core/dp/txrx/ol_txrx.c +++ b/core/dp/txrx/ol_txrx.c @@ -2470,8 +2470,8 @@ ol_txrx_peer_attach(ol_txrx_vdev_handle vdev, uint8_t *peer_mac_addr) OL_TXRX_PEER_INC_REF_CNT(peer); peer->valid = 1; - qdf_mc_timer_init(&peer->peer_unmap_timer, QDF_TIMER_TYPE_SW, - peer_unmap_timer_handler, peer); + qdf_timer_init(pdev->osdev, &peer->peer_unmap_timer, + peer_unmap_timer_handler, peer, QDF_TIMER_TYPE_SW); ol_txrx_peer_find_hash_add(pdev, peer); @@ -3126,7 +3126,8 @@ int ol_txrx_peer_unref_delete(ol_txrx_peer_handle peer, vdev->wait_on_peer_id = OL_TXRX_INVALID_LOCAL_PEER_ID; } - qdf_mc_timer_destroy(&peer->peer_unmap_timer); + qdf_timer_sync_cancel(&peer->peer_unmap_timer); + qdf_timer_free(&peer->peer_unmap_timer); /* check whether the parent vdev has no peers left */ if (TAILQ_EMPTY(&vdev->peer_list)) { @@ -3346,11 +3347,10 @@ void ol_txrx_peer_detach(ol_txrx_peer_handle peer) * Create a timer to track unmap events when the sta peer gets deleted. */ if (vdev->opmode == wlan_op_mode_sta) { - qdf_mc_timer_start(&peer->peer_unmap_timer, - OL_TXRX_PEER_UNMAP_TIMEOUT); - ol_txrx_info( - "%s: started peer_unmap_timer for peer %p", - __func__, peer); + qdf_timer_start(&peer->peer_unmap_timer, + OL_TXRX_PEER_UNMAP_TIMEOUT); + ol_txrx_info("%s: started peer_unmap_timer for peer %p", + __func__, peer); } /* diff --git a/core/dp/txrx/ol_txrx_types.h b/core/dp/txrx/ol_txrx_types.h index f9c1ab328a51..db7fd194b8f5 100644 --- a/core/dp/txrx/ol_txrx_types.h +++ b/core/dp/txrx/ol_txrx_types.h @@ -1243,7 +1243,7 @@ struct ol_txrx_peer_t { qdf_time_t last_disassoc_rcvd; qdf_time_t last_deauth_rcvd; qdf_atomic_t fw_create_pending; - qdf_mc_timer_t peer_unmap_timer; + qdf_timer_t peer_unmap_timer; }; enum ol_rx_err_type { -- cgit v1.2.3