commit be316c9c24186e53739cde39a367081d646072ed
author Padma, Santhosh Kumar <skpadma@qti.qualcomm.com> Mon Sep 14 18:29:55 2015 +0530
committer Satyanarayana Dash <sadash@codeaurora.org> Wed Sep 16 18:25:18 2015 +0530
tree 2211f8c21fa37da992139fc89ddb328d097e214c
parent 0433841ab1575ad7af565fa49405fe63cd68e736

prima: Protect pHashTable with lock

Functions limIsDeauthDiassocForDrop in Rx thread context
and peDeleteSession in MC thread context can access variable
pHashTable simulataneously. This can lead to crash as memory
for pHashTable can be deleted in MC thread context and the
same can be referenced in Rx thread context. Fix this by
protecting usage of pHashTable with a lock.

Change-Id: If6346f4cf5b2a2386a8866e03b9a9fbcb514e78e
CRs-Fixed: 906431

CORE/MAC/src/pe/lim/limApi.c

diff --git a/CORE/MAC/src/pe/lim/limApi.c b/CORE/MAC/src/pe/lim/limApi.c
index 0e35219..f4fa99c 100644
--- a/CORE/MAC/src/pe/lim/limApi.c
+++ b/CORE/MAC/src/pe/lim/limApi.c
@@ -2416,6 +2416,8 @@
     tpPESession     psessionEntry;
     tpSirMacMgmtHdr pMacHdr;
     tpDphHashNode     pStaDs;
+    eHalStatus lock_status = eHAL_STATUS_SUCCESS;
+    boolean ret = FALSE;
 
     pMacHdr = WDA_GET_RX_MAC_HEADER(pRxPacketInfo);
     psessionEntry = peFindSessionByBssid(pMac,pMacHdr->bssId,&sessionId);
@@ -2426,12 +2428,21 @@
                   pMacHdr->sa););
         return TRUE;
     }
+
+    lock_status =  pe_AcquireGlobalLock(&pMac->lim);
+    if (lock_status != eHAL_STATUS_SUCCESS)
+    {
+        limLog(pMac, LOGE, FL("pe_AcquireGlobalLock error"));
+        return TRUE;
+    }
+
     pStaDs = dphLookupHashEntry(pMac, pMacHdr->sa, &aid,
                                &psessionEntry->dph.dphHashTable);
     if (!pStaDs)
     {
         PELOG1(sysLog(pMac, LOG1,FL("pStaDs is NULL")););
-        return TRUE;
+        ret = TRUE;
+        goto end;
     }
 #ifdef WLAN_FEATURE_11W
     if (psessionEntry->limRmfEnabled)
@@ -2446,7 +2457,10 @@
              * a time difference of 1 sec.
              */
             if (vos_timer_get_system_time() - pStaDs->last_unprot_deauth_disassoc < 1000)
-                return TRUE;
+            {
+                ret = TRUE;
+                goto end;
+            }
             pStaDs->last_unprot_deauth_disassoc =
                               vos_timer_get_system_time();
         }
@@ -2454,7 +2468,10 @@
         else
         {
             if (pStaDs->proct_deauh_disassoc_cnt)
-                return TRUE;
+            {
+                ret = TRUE;
+                goto end;
+            }
             else
                 pStaDs->proct_deauh_disassoc_cnt++;
         }
@@ -2464,11 +2481,17 @@
 /* PMF disabled */
     {
         if (pStaDs->isDisassocDeauthInProgress)
-            return TRUE;
+        {
+            ret = TRUE;
+            goto end;
+        }
          else
             pStaDs->isDisassocDeauthInProgress++;
     }
-    return FALSE;
+
+end:
+    pe_ReleaseGlobalLock(&pMac->lim);
+    return ret;
 }
 /** -----------------------------------------------------------------
   \brief limIsPktCandidateForDrop() - decides whether to drop the frame or not