commit b156c92ef4f4416a6483c82aee1d1e3930598686
author Jeff Johnson <jjohnson@qca.qualcomm.com> Thu Dec 05 17:19:46 2013 -0800
committer Kiet Lam <c_kietl@qca.qualcomm.com> Sun Dec 22 14:40:05 2013 -0800
tree 19eab561ca0130c83e43320ef9ab6d898237bba2
parent 111cff4cf4dd8608efb4fd15f8d28afd9d523f24

wlan: Add adapter MAGIC checking in *_tx_fetch_packet_cbk()

A kernel panic in _list_del_entry() was observed when SoftAP was
disabled.  Root cause is that when the SoftAP function was disabled
and the pAdapter was freed, the TX Thread was blocked. When the TX
Thread subsequently unblocked, a stale pAdapter was dereferenced.  Add
adapter MAGIC checking to the *_tx_fetch_packet_cbk() functions to
prevent dereference of a stale pAdapter.

Change-Id: Ief12257ab0f89dba6acf8d86c20f526d90426d7c
CRs-fixed: 580814

CORE/HDD/src/wlan_hdd_softap_tx_rx.c

diff --git a/CORE/HDD/src/wlan_hdd_softap_tx_rx.c b/CORE/HDD/src/wlan_hdd_softap_tx_rx.c
index bf275ae..a7b4024 100644
--- a/CORE/HDD/src/wlan_hdd_softap_tx_rx.c
+++ b/CORE/HDD/src/wlan_hdd_softap_tx_rx.c
@@ -1002,13 +1002,28 @@
       return VOS_STATUS_E_FAILURE;
    }
 
-   pAdapter = pHddCtx->sta_to_adapter[*pStaId];
-   if( NULL == pAdapter )
+   STAId = *pStaId;
+   if (STAId >= WLAN_MAX_STA_COUNT)
+   {
+      VOS_TRACE( VOS_MODULE_ID_HDD_SOFTAP, VOS_TRACE_LEVEL_ERROR,
+                 "%s: Invalid STAId %d passed by TL", __func__, STAId);
+      return VOS_STATUS_E_FAILURE;
+   }
+
+   pAdapter = pHddCtx->sta_to_adapter[STAId];
+   if ((NULL == pAdapter) || (WLAN_HDD_ADAPTER_MAGIC != pAdapter->magic))
    {
       VOS_ASSERT(0);
       return VOS_STATUS_E_FAILURE;
    }
  
+   if (FALSE == pAdapter->aStaInfo[STAId].isUsed )
+   {
+      VOS_TRACE( VOS_MODULE_ID_HDD_SOFTAP, VOS_TRACE_LEVEL_ERROR,
+                 "%s: Unregistered STAId %d passed by TL", __func__, STAId);
+      return VOS_STATUS_E_FAILURE;
+   }
+
    /* Monitor traffic */
    if ( pHddCtx->cfg_ini->enableTrafficMonitor )
    {
@@ -1031,21 +1046,6 @@
 
    ++pAdapter->hdd_stats.hddTxRxStats.txFetched;
 
-   STAId = *pStaId;
-   if (STAId >= WLAN_MAX_STA_COUNT)
-   {
-      VOS_TRACE( VOS_MODULE_ID_HDD_SOFTAP, VOS_TRACE_LEVEL_ERROR,
-                 "%s: Invalid STAId %d passed by TL", __func__, STAId);
-      return VOS_STATUS_E_FAILURE;
-   }
-
-   if (FALSE == pAdapter->aStaInfo[STAId].isUsed )
-   {
-      VOS_TRACE( VOS_MODULE_ID_HDD_SOFTAP, VOS_TRACE_LEVEL_ERROR,
-                 "%s: Unregistered STAId %d passed by TL", __func__, STAId);
-      return VOS_STATUS_E_FAILURE;
-   }
-
    *ppVosPacket = NULL;
 
    //Make sure the AC being asked for is sane