qcacld-3.0: Don't process scan command when vdev delete is in process
When driver performs vdev delete operation, it changes vdev state
to logically deleted or physically deleted only after receiving vdev
delete command's response from FW. In between (sending vdev del req
and receiving vdev del rsp) if thread gets pre-empted and other thread
start posting command (like scan command) to process then it could
lead to use after free scenario.
Notify scan component when vdev delete is intiated and let scan
component record that in to vdev's scan private object as one of the
flags.
check this flag before processing the scan command.
CRs-Fixed: 2265542
Change-Id: Id884d6c42cd8766e70835808863632e096158487
diff --git a/core/hdd/src/wlan_hdd_main.c b/core/hdd/src/wlan_hdd_main.c
index 29720fe..f9bdec8 100644
--- a/core/hdd/src/wlan_hdd_main.c
+++ b/core/hdd/src/wlan_hdd_main.c
@@ -3852,6 +3852,7 @@
return -EINVAL;
}
status = ucfg_reg_11d_vdev_delete_update(adapter->hdd_vdev);
+ ucfg_scan_set_vdev_del_in_progress(adapter->hdd_vdev);
/* close sme session (destroy vdev in firmware via legacy API) */
qdf_event_reset(&adapter->qdf_session_close_event);
@@ -3888,6 +3889,7 @@
}
release_vdev:
+ ucfg_scan_clear_vdev_del_in_progress(adapter->hdd_vdev);
/*
* In SSR or driver unloading case, directly exit may cause objects
* leak, if sme_close_session failed. Free objects anyway.