qcacld-3.0: Avoid NULL skb dereference during softap TX
Change "qcacld-3.0: Record data in DP Trace" introduced skb tracing
functionity to the driver. In hdd_softap_hard_start_xmit() logic was
added to trace the skb contents, including logic to trace the skb
contents when an skb was dropped. However some of the code paths to
this "drop_pkt" tracing have a NULL skb. Therefore we must bypass the
dropped skb content tracing when the skb is NULL.
Change-Id: I485c92647355a0f7f420f40640b697a1d3eb5fb0
CRs-Fixed: 938254
diff --git a/core/hdd/src/wlan_hdd_softap_tx_rx.c b/core/hdd/src/wlan_hdd_softap_tx_rx.c
index 6626ca2..8f98dcf 100644
--- a/core/hdd/src/wlan_hdd_softap_tx_rx.c
+++ b/core/hdd/src/wlan_hdd_softap_tx_rx.c
@@ -288,7 +288,7 @@
/* Check if the buffer has enough header room */
skb = skb_unshare(skb, GFP_ATOMIC);
if (!skb)
- goto drop_pkt;
+ goto drop_pkt_accounting;
if (skb_headroom(skb) < dev->hard_header_len) {
struct sk_buff *tmp;
@@ -296,7 +296,7 @@
skb = skb_realloc_headroom(tmp, dev->hard_header_len);
dev_kfree_skb(tmp);
if (!skb)
- goto drop_pkt;
+ goto drop_pkt_accounting;
}
#if defined (IPA_OFFLOAD)
}
@@ -357,10 +357,11 @@
DPTRACE(cdf_dp_trace(skb, CDF_DP_TRACE_DROP_PACKET_RECORD,
(uint8_t *)&skb->data[CDF_DP_TRACE_RECORD_SIZE],
(cdf_nbuf_len(skb)-CDF_DP_TRACE_RECORD_SIZE)));
+ kfree_skb(skb);
+drop_pkt_accounting:
++pAdapter->stats.tx_dropped;
++pAdapter->hdd_stats.hddTxRxStats.txXmitDropped;
- kfree_skb(skb);
return NETDEV_TX_OK;
}