Bladeren bron

qcacmn: Fix use after free reported by KASAN

Vdev id is freed after wmi send, it can't be referenced anymore.

Change-Id: I2cb63a28daa36f292903261df1c23c717ec63a9f
CRs-Fixed: 3834424
Yu Tian 1 jaar geleden
bovenliggende
commit
98e66d3da1
1 gewijzigde bestanden met toevoegingen van 2 en 1 verwijderingen
  1. 2 1
      wmi/src/wmi_unified_tlv.c

+ 2 - 1
wmi/src/wmi_unified_tlv.c

@@ -1183,6 +1183,7 @@ static QDF_STATUS send_vdev_stop_cmd_tlv(wmi_unified_t wmi,
 	wmi_buf_t buf;
 	int32_t len = sizeof(*cmd);
 	uint8_t *buf_ptr;
+	uint32_t vdev_id = params->vdev_id;
 
 	len += vdev_stop_mlo_params_size(params);
 
@@ -1205,7 +1206,7 @@ static QDF_STATUS send_vdev_stop_cmd_tlv(wmi_unified_t wmi,
 		wmi_buf_free(buf);
 		return QDF_STATUS_E_FAILURE;
 	}
-	wmi_debug("vdev id = %d", cmd->vdev_id);
+	wmi_debug("vdev id = %d", vdev_id);
 
 	return 0;
 }