浏览代码

qcacld-3.0: Remove use-after-free of frame in tx mgmt send

The tx completion handler for the frame frees the buffer.
Therefore, usage of frame after tx completion causes undesired
effect.

Remove the dereference of tx frame buffer contents in
lim_tx_mgmt_frame() after the tx completion.

Change-Id: I32211e1bce4f96ba920a2212ef65aa39831666ab
CRs-Fixed: 3772014
Surya Prakash Sivaraj 1 年之前
父节点
当前提交
3197a206ad
共有 1 个文件被更改,包括 1 次插入2 次删除
  1. 1 2
      core/mac/src/pe/lim/lim_send_management_frames.c

+ 1 - 2
core/mac/src/pe/lim/lim_send_management_frames.c

@@ -7450,8 +7450,7 @@ static void lim_tx_mgmt_frame(struct mac_context *mac_ctx, uint8_t vdev_id,
 	MTRACE(qdf_trace(QDF_MODULE_ID_PE, TRACE_CODE_TX_COMPLETE,
 		session_id, qdf_status));
 	if (!QDF_IS_STATUS_SUCCESS(qdf_status)) {
-		pe_err("*** Could not send Auth frame (subType: %d), retCode=%X ***",
-			fc->subType, qdf_status);
+		pe_err("Could not send Auth frame, retCode=%X", qdf_status);
 		mac_ctx->auth_ack_status = LIM_TX_FAILED;
 		auth_ack_status = SENT_FAIL;
 		lim_diag_event_report(mac_ctx, WLAN_PE_DIAG_AUTH_ACK_EVENT,