Prechádzať zdrojové kódy

qcacmn: Fix pointer dereference after memory free

The pointer to peer is dereferenced after memory free in peer
_unref_delete function. Fix the issue by changing function
call sequence.

CRs-Fixed: 2167698
Change-Id: Iebd8f958bde4964c16a3c312d037e8f06e319350
chenguo 7 rokov pred
rodič
commit
1dead6f99e
1 zmenil súbory, kde vykonal 5 pridanie a 5 odobranie
  1. 5 5
      dp/wifi3.0/dp_main.c

+ 5 - 5
dp/wifi3.0/dp_main.c

@@ -3683,6 +3683,11 @@ void dp_peer_unref_delete(void *peer_handle)
 		} else {
 			qdf_spin_unlock_bh(&soc->peer_ref_mutex);
 		}
+
+		if (soc->cdp_soc.ol_ops->peer_unref_delete) {
+			soc->cdp_soc.ol_ops->peer_unref_delete(pdev->osif_pdev,
+					vdev->vdev_id, peer->mac_addr.raw);
+		}
 #ifdef notyet
 		qdf_mempool_free(soc->osdev, soc->mempool_ol_ath_peer, peer);
 #else
@@ -3695,11 +3700,6 @@ void dp_peer_unref_delete(void *peer_handle)
 free_peer:
 		qdf_mem_free(peer);
 #endif
-		if (soc->cdp_soc.ol_ops->peer_unref_delete) {
-			soc->cdp_soc.ol_ops->peer_unref_delete(pdev->osif_pdev,
-					vdev->vdev_id, peer->mac_addr.raw);
-		}
-
 	} else {
 		qdf_spin_unlock_bh(&soc->peer_ref_mutex);
 	}