Skip to content

Commit d7ca501

Browse files
committed
[nrf fromlist] drivers: wifi: Clean up exit path
Fix couple of bugs in exit path: - In case of calloc failure, return's without unlocking - memory is freed outside lock, in case of a tiny window of race, this can cause a crash when this function is called from two threads. Upstream PR: zephyrproject-rtos/zephyr#79891 Signed-off-by: Chaitanya Tata <[email protected]>
1 parent 027e24d commit d7ca501

File tree

1 file changed

+3
-4
lines changed

1 file changed

+3
-4
lines changed

drivers/wifi/nrfwifi/src/net_if.c

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -440,7 +440,7 @@ static void ip_maddr_event_handler(struct net_if *iface,
440440
ret = k_mutex_lock(&vif_ctx_zep->vif_lock, K_FOREVER);
441441
if (ret != 0) {
442442
LOG_ERR("%s: Failed to lock vif_lock", __func__);
443-
goto out;
443+
return;
444444
}
445445

446446
rpu_ctx_zep = vif_ctx_zep->rpu_ctx_zep;
@@ -455,7 +455,7 @@ static void ip_maddr_event_handler(struct net_if *iface,
455455
if (!mcast_info) {
456456
LOG_ERR("%s: Unable to allocate memory of size %d "
457457
"for mcast_info", __func__, sizeof(*mcast_info));
458-
return;
458+
goto unlock;
459459
}
460460

461461
switch (addr->family) {
@@ -492,9 +492,8 @@ static void ip_maddr_event_handler(struct net_if *iface,
492492
sizeof(mac_string_buf)));
493493
}
494494
unlock:
495-
k_mutex_unlock(&vif_ctx_zep->vif_lock);
496-
out:
497495
k_free(mcast_info);
496+
k_mutex_unlock(&vif_ctx_zep->vif_lock);
498497
}
499498
#endif /* CONFIG_NRF70_STA_MODE */
500499

0 commit comments

Comments
 (0)