Browse Source

qcacmn: Move psoc_obj_destroy_notification to avoid access freed psoc

Move wlan_mgmt_rx_reo_psoc_obj_destroy_notification before
wlan_objmgr_psoc_component_obj_detach to avoid access freed psoc memory

Change-Id: I8141bef1bfddfbee1335a9adecb2aa1818c8611a
CRs-Fixed: 3620074
Guru Pratap Sharma 1 year ago
parent
commit
0c9433f93d

+ 8 - 6
umac/cmn_services/mgmt_txrx/dispatcher/src/wlan_mgmt_txrx_utils_api.c

@@ -128,12 +128,6 @@ static QDF_STATUS wlan_mgmt_txrx_psoc_obj_destroy_notification(
 
 	mgmt_txrx_debug("deleting mgmt txrx psoc obj, mgmt txrx ctx: %pK, psoc: %pK",
 			mgmt_txrx_psoc_ctx, psoc);
-	if (wlan_objmgr_psoc_component_obj_detach(psoc,
-				WLAN_UMAC_COMP_MGMT_TXRX, mgmt_txrx_psoc_ctx)
-			!= QDF_STATUS_SUCCESS) {
-		mgmt_txrx_err("Failed to detach mgmt txrx ctx in psoc ctx");
-		return QDF_STATUS_E_FAILURE;
-	}
 
 	status = wlan_mgmt_rx_reo_psoc_obj_destroy_notification(psoc);
 	if (QDF_IS_STATUS_ERROR(status)) {
@@ -141,6 +135,14 @@ static QDF_STATUS wlan_mgmt_txrx_psoc_obj_destroy_notification(
 		return status;
 	}
 
+	if (wlan_objmgr_psoc_component_obj_detach(psoc,
+						  WLAN_UMAC_COMP_MGMT_TXRX,
+						  mgmt_txrx_psoc_ctx)
+			!= QDF_STATUS_SUCCESS) {
+		mgmt_txrx_err("Failed to detach mgmt txrx ctx in psoc ctx");
+		return QDF_STATUS_E_FAILURE;
+	}
+
 	qdf_spinlock_destroy(&mgmt_txrx_psoc_ctx->mgmt_txrx_psoc_ctx_lock);
 	qdf_mem_free(mgmt_txrx_psoc_ctx);