qcacmn: Cleanup defrag waitlist when removing peer
Peer's RX TID may already be added to defrag's waitlist when it is
removed. Then use-after-free occurs when waitlist be accessed later.
Remove current peer's entries from waitlist, before it is freed.
As waitlist may be accessed from two contexts, additional lock
introduced to protect waitlist.
CRs-Fixed: 2244566
Change-Id: I8f1935973372a81086e9dbd992ac771b6709a677
diff --git a/dp/wifi3.0/dp_peer.c b/dp/wifi3.0/dp_peer.c
index a2474e5..d947e46 100644
--- a/dp/wifi3.0/dp_peer.c
+++ b/dp/wifi3.0/dp_peer.c
@@ -22,6 +22,7 @@
#include "dp_types.h"
#include "dp_internal.h"
#include "dp_peer.h"
+#include "dp_rx_defrag.h"
#include <hal_api.h>
#include <hal_reo.h>
#ifdef CONFIG_MCL
@@ -1570,6 +1571,11 @@
for (tid = 0; tid < DP_MAX_TIDS; tid++) {
if (peer->rx_tid[tid].hw_qdesc_vaddr_unaligned != NULL) {
dp_rx_tid_delete_wifi3(peer, tid);
+
+ /* Cleanup defrag related resource */
+ dp_rx_defrag_waitlist_remove(peer, tid);
+ dp_rx_reorder_flush_frag(peer, tid);
+
tid_delete_mask |= (1 << tid);
}
}