Browse Source

qcacld-3.0: Fix sta_info use after free in hdd_softap_stop_bss

In hdd_softap_deregister_sta, cdp_clear_peer may return fail
as peer has been deleted in other path, but the free of sta_info
will be continue.
So in hdd_softap_stop_bss, it will still access mac address
from sta_info, which will cause use after free.

Fix:
   Even cdp_clear_peer return failure, it is expected, so only
   log but not return failure to caller function.
   In hdd_softap_stop_bss, remove mac address info log as in
   hdd_softap_deregister_sta, there has been enough log for
   each failure case.

Change-Id: Id06c78cb8d215488eb34d8412359ac2d684756d5
CRs-Fixed: 2637287
Jingxiang Ge 5 years ago
parent
commit
2131384024
1 changed files with 1 additions and 6 deletions
  1. 1 6
      core/hdd/src/wlan_hdd_softap_tx_rx.c

+ 1 - 6
core/hdd/src/wlan_hdd_softap_tx_rx.c

@@ -1010,7 +1010,7 @@ QDF_STATUS hdd_softap_deregister_sta(struct hdd_adapter *adapter,
 
 	ucfg_mlme_update_oce_flags(hdd_ctx->pdev);
 
-	return qdf_status;
+	return QDF_STATUS_SUCCESS;
 }
 
 QDF_STATUS hdd_softap_register_sta(struct hdd_adapter *adapter,
@@ -1194,11 +1194,6 @@ QDF_STATUS hdd_softap_stop_bss(struct hdd_adapter *adapter)
 	hdd_for_each_station_safe(adapter->sta_info_list, sta_info,
 				  index, tmp) {
 		status = hdd_softap_deregister_sta(adapter, &sta_info);
-
-		if (QDF_IS_STATUS_ERROR(status) && sta_info)
-			hdd_debug("Deregistering STA " QDF_MAC_ADDR_STR
-				  " failed",
-				  QDF_MAC_ADDR_ARRAY(sta_info->sta_mac.bytes));
 	}
 
 	if (adapter->device_mode == QDF_SAP_MODE &&