Procházet zdrojové kódy

qcacld-3.0: Reset global saved command to avoid double free

Reset the global saved scan command to avoid double free.
In sme_process_set_hw_mode_resp(), after freeing the local
saved_cmd pointer, the global mac->sme.saved_scan_cmd is
not reset to NULL. This ends up in double free in
csr_scan_complete()->csr_handle_nxt_cmd() where we are
still holding a stale pointer.

CRs-Fixed: 941130
Change-Id: Ibb93b8d8e601936c7996518f21646e2c140cbd20
Chandrasekaran, Manishekar před 9 roky
rodič
revize
19c6cb5282
1 změnil soubory, kde provedl 1 přidání a 0 odebrání
  1. 1 0
      core/sme/src/common/sme_api.c

+ 1 - 0
core/sme/src/common/sme_api.c

@@ -228,6 +228,7 @@ static CDF_STATUS sme_process_set_hw_mode_resp(tpAniSirGlobal mac, uint8_t *msg)
 			if (saved_cmd) {
 				cdf_mem_free(saved_cmd);
 				saved_cmd = NULL;
+				mac->sme.saved_scan_cmd = NULL;
 			}
 		} else {
 			sms_log(mac, LOGE,