commit b392b6496169f9566c947f4c6b7e038cd331e118
author Mukul Sharma <mukul@codeaurora.org> Thu Aug 17 17:45:29 2017 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> Thu Aug 31 01:55:44 2017 -0700
tree 54b97c36584e6beb48351f9198ccf93acb609cc7
parent e3beee29b536216c1dd268c37166e8e1e7cea410

wlan: Change abort scan from interruptible to non interruptible

Currently, HDD uses wait_for_completion_interruptible_timeout
hence due to interrupt this thread may be preempted and kernel
free this scan request during processing of cfg_netdev_notifer.
Later when scan got aborted by UMAC and it notifies to user space
through scan done callback which access  freed scan request and
which leads to page fault.

As a part of fix, HDD now uses wait_for_completion_timeout so scan
abort get sufficient time and get response from UMAC.

Change-Id: If8cc25f3d88f6a84b6497d7982c9306bf6f61cff
CRs-fixed: 2095190

CORE/HDD/src/wlan_hdd_cfg80211.c

diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index 2d61329..c9c56e8 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -13501,7 +13501,7 @@
 }
 #endif
 
-
+#define NET_DEV_IS_IFF_UP(pAdapter) (pAdapter->dev->flags & IFF_UP)
 /*
  * FUNCTION: hdd_cfg80211_scan_done_callback
  * scanning callback function, called after finishing scan
@@ -13517,9 +13517,6 @@
     struct cfg80211_scan_request *req = NULL;
     int ret = 0;
     bool aborted = false;
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
-    bool iface_down = false;
-#endif
     long waitRet = 0;
     tANI_U8 i;
     hdd_context_t *pHddCtx;
@@ -13538,10 +13535,9 @@
     }
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
-    if (!(pAdapter->dev->flags & IFF_UP))
+    if (!NET_DEV_IS_IFF_UP(pAdapter))
     {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("Interface is down"));
-        iface_down = true;
     }
 #endif
     pScanInfo = &pHddCtx->scan_info;
@@ -13581,7 +13577,7 @@
     }
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
-    if (!iface_down)
+    if (NET_DEV_IS_IFF_UP(pAdapter))
 #endif
     {
         ret = wlan_hdd_cfg80211_update_bss((WLAN_HDD_GET_CTX(pAdapter))->wiphy,
@@ -13627,7 +13623,7 @@
     {
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
             hddLog(VOS_TRACE_LEVEL_ERROR, FL("interface state %s"),
-                   iface_down ? "up" : "down");
+                   NET_DEV_IS_IFF_UP(pAdapter) ? "up" : "down");
 #endif
 
         if (pAdapter->dev) {
@@ -13669,7 +13665,8 @@
     }
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
-    if (!iface_down)
+    if (NET_DEV_IS_IFF_UP(pAdapter) &&
+        wlan_hdd_cfg80211_validate_scan_req(req, pHddCtx))
 #endif
         cfg80211_scan_done(req, aborted);
 
@@ -13696,7 +13693,7 @@
     hdd_prevent_suspend_timeout(1000, WIFI_POWER_EVENT_WAKELOCK_SCAN);
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
-    if (!iface_down)
+    if (NET_DEV_IS_IFF_UP(pAdapter))
 #endif
 #ifdef FEATURE_WLAN_TDLS
         wlan_hdd_tdls_scan_done_callback(pAdapter);