commit 4bff0e01be65ca191223ba100871d3fbafa2840c
author Jayachandran S <jsreekum@codeaurora.org> Fri Feb 16 19:22:50 2018 +0530
committer Anjaneedevi Kapparapu <akappara@codeaurora.org> Wed Mar 14 15:42:10 2018 +0530
tree 692078cb27cce20b6fb45bec757f7556db3c2f86
parent 47d0f905e9ebeb46bbea7cddcbafbcb0e9b88bbc

qcacld-2.0: Handle skb head room allocation failure in Monitor mode

Sometimes the pskb_expand_head fails to allocate head room.
There is no check for the above failure. It leads to NULL pointer access.

Do not perform any skb operation in case of such failure.

Change-Id: I4ea4b23b3863d0dd43cd6bba550fd299bed2887c
CRs-Fixed: 2184024

CORE/HDD/src/wlan_hdd_tx_rx.c

diff --git a/CORE/HDD/src/wlan_hdd_tx_rx.c b/CORE/HDD/src/wlan_hdd_tx_rx.c
index d484159..8e9464f 100644
--- a/CORE/HDD/src/wlan_hdd_tx_rx.c
+++ b/CORE/HDD/src/wlan_hdd_tx_rx.c
@@ -1143,29 +1143,37 @@
  * For HL monitor mode, radiotap is appended to tail when update radiotap
  * info in htt layer. Need to copy it ahead of skb before indicating to OS.
  */
-static void hdd_move_radiotap_header_forward(struct sk_buff *skb)
+static VOS_STATUS hdd_move_radiotap_header_forward(struct sk_buff *skb)
 {
 	adf_nbuf_t msdu = (adf_nbuf_t)skb;
 	struct ieee80211_radiotap_header *rthdr;
 	uint8_t rtap_len;
 
-	adf_nbuf_put_tail(msdu,
+	if (!adf_nbuf_put_tail(msdu,
+		sizeof(struct ieee80211_radiotap_header)))
+		return VOS_STATUS_E_NOMEM;
+	else {
+		rthdr = (struct ieee80211_radiotap_header *)
+		(adf_nbuf_data(msdu) + adf_nbuf_len(msdu) -
 		sizeof(struct ieee80211_radiotap_header));
-	rthdr = (struct ieee80211_radiotap_header *)
-	    (adf_nbuf_data(msdu) + adf_nbuf_len(msdu) -
-	     sizeof(struct ieee80211_radiotap_header));
-	rtap_len = rthdr->it_len;
-	adf_nbuf_put_tail(msdu,
+		rtap_len = rthdr->it_len;
+		if (!adf_nbuf_put_tail(msdu,
 			  rtap_len -
-			  sizeof(struct ieee80211_radiotap_header));
-	adf_nbuf_push_head(msdu, rtap_len);
-	adf_os_mem_copy(adf_nbuf_data(msdu), rthdr, rtap_len);
-	adf_nbuf_trim_tail(msdu, rtap_len);
+			  sizeof(struct ieee80211_radiotap_header)))
+			return VOS_STATUS_E_NOMEM;
+		else {
+			adf_nbuf_push_head(msdu, rtap_len);
+			adf_os_mem_copy(adf_nbuf_data(msdu), rthdr, rtap_len);
+			adf_nbuf_trim_tail(msdu, rtap_len);
+		}
+	}
+	return VOS_STATUS_SUCCESS;
 }
 #else
-static inline void hdd_move_radiotap_header_forward(struct sk_buff *skb)
+static inline VOS_STATUS hdd_move_radiotap_header_forward(struct sk_buff *skb)
 {
     /* no-op */
+	return VOS_STATUS_SUCCESS;
 }
 #endif
 
@@ -1218,11 +1226,14 @@
 	/* walk the chain until all are processed */
 	skb = (struct sk_buff *) rx_buf;
 	while (NULL != skb) {
-		hdd_move_radiotap_header_forward(skb);
-
 		skb_next = skb->next;
 		skb->dev = adapter->dev;
 
+		if(hdd_move_radiotap_header_forward(skb)) {
+			skb = skb_next;
+			continue;
+		}
+
 		++adapter->hdd_stats.hddTxRxStats.rxPackets[cpu_index];
 		++adapter->stats.rx_packets;
 		adapter->stats.rx_bytes += skb->len;