Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6e000465 authored by Yu Tian's avatar Yu Tian Committed by Gerrit - the friendly Code Review server
Browse files

qcacmn: avoid of HTC buffer double free in HTC send failure case 

HTC buffer is freed in enqueue failure case. Then it is requeued to
htt_htc_pkt_misclist also. In deinit flow, misclist entry should be
cleared, so buffer double free is hit in this stage. Make a change
to not requeue this frame to misclist.

Change-Id: I0211c4b548d7df7176ee72a83e21f8fcf7fa464c
CRs-Fixed: 2942972
parent 0b286aa1

dp/wifi3.0/dp_htt.c

+5 −1
Original line number Diff line number Diff line
@@ -50,6 +50,10 @@ 
#define HTT_SHIFT_UPPER_TIMESTAMP 32

#define HTT_MASK_UPPER_TIMESTAMP 0xFFFFFFFF00000000



#define HTT_HTC_PKT_STATUS_SUCCESS \

	((pkt->htc_pkt.Status != QDF_STATUS_E_CANCELED) && \

	(pkt->htc_pkt.Status != QDF_STATUS_E_RESOURCES))



/*

 * dp_htt_get_ppdu_sniffer_ampdu_tlv_bitmap() - Get ppdu stats tlv

 * bitmap for sniffer mode
@@ -619,7 +623,7 @@ static inline QDF_STATUS DP_HTT_SEND_HTC_PKT(struct htt_soc *soc, 
	htt_command_record(soc->htt_logger_handle, cmd, buf);



	status = htc_send_pkt(soc->htc_soc, &pkt->htc_pkt);

	if (status == QDF_STATUS_SUCCESS)

	if (status == QDF_STATUS_SUCCESS && HTT_HTC_PKT_STATUS_SUCCESS)

		htt_htc_misc_pkt_list_add(soc, pkt);

	else

		soc->stats.fail_count++;