wlan: Fix Race Condition in WDA_TxPacket.
In WDA_TxPacket(VosMCThread) in case of Tx timeout, 1st callback
is set as null and then flag is set as timeout. While in
WDA_TxComplete(VosTXThread), 1st it check whether flag is timedout
and then it checks for callback to free Vos Pkt. Hence a race
condition arises whereby Vos Pkt can never be free.
As a prt of fix made sure that in both thread condition check is
in same order.
Change-Id: Ic01d433b40f6282e4b4b049c1e7ddae66220733d
CRs-Fixed: 771010
diff --git a/CORE/WDA/src/wlan_qct_wda.c b/CORE/WDA/src/wlan_qct_wda.c
index 364836c..32d90d1 100644
--- a/CORE/WDA/src/wlan_qct_wda.c
+++ b/CORE/WDA/src/wlan_qct_wda.c
@@ -12217,6 +12217,7 @@
"%s:pWDA is NULL",
__func__);
VOS_ASSERT(0);
+ vos_pkt_return_packet(pData);
return VOS_STATUS_E_FAILURE;
}
@@ -12445,16 +12446,16 @@
VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
"%s: Status %d when waiting for TX Frame Event",
__func__, status);
+
+ /*Tag Frame as timed out for later deletion*/
+ vos_pkt_set_user_data_ptr( (vos_pkt_t *)pFrmBuf, VOS_PKT_USER_DATA_ID_WDA,
+ (v_PVOID_t)WDA_TL_TX_MGMT_TIMED_OUT);
pWDA->pTxCbFunc = NULL; /*To stop the limTxComplete being called again ,
after the packet gets completed(packet freed once)*/
/* TX MGMT fail with COMP timeout, try to detect DXE stall */
WDA_TransportChannelDebug(pMac, 1, 0);
- /*Tag Frame as timed out for later deletion*/
- vos_pkt_set_user_data_ptr( (vos_pkt_t *)pFrmBuf, VOS_PKT_USER_DATA_ID_WDA,
- (v_PVOID_t)WDA_TL_TX_MGMT_TIMED_OUT);
-
/* check whether the packet was freed already,so need not free again when
* TL calls the WDA_Txcomplete routine
*/