samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Fix double free in csr_roaming_state_config_cnf_processor

Browse Source 
The beacon ie of AP to connect in sme cmd may be freed and set to
NULL in csr_roam if csr_roam_issue_join failed,
scan_result->Result.pvIes may be different in start and end of
csr_roaming_state_config_cnf_processor.

Fixed by using a local bool val to mark whether beacon ie is new
malloced and need free.

Change-Id: I04ec952273a28a3b8a215dd6812bba213ff5309a
CRs-Fixed: 2284311
This commit is contained in:
Jianmin Zhu
2018-07-26 19:40:25 +08:00
committed by nshrivas
parent 5d54cb1ba4
commit a0d8e00d02
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
core/sme/src/csr/csr_api_roam.c
View File

@@ -9912,6 +9912,7 @@ csr_roaming_state_config_cnf_processor(tpAniSirGlobal mac_ctx,
uint32_t session_id;
struct csr_roam_session *session;
tDot11fBeaconIEs *local_ies = NULL;
bool is_ies_malloced = false;
QDF_STATUS status = QDF_STATUS_E_FAILURE;
if (NULL == cmd) {
@@ -10021,6 +10022,7 @@ csr_roaming_state_config_cnf_processor(tpAniSirGlobal mac_ctx,
&local_ies);
if (!QDF_IS_STATUS_SUCCESS(status))
return;
is_ies_malloced = true;
}
if (csr_is_conn_state_connected_infra(mac_ctx, session_id)) {
@@ -10090,7 +10092,7 @@ csr_roaming_state_config_cnf_processor(tpAniSirGlobal mac_ctx,
csr_roam(mac_ctx, cmd);
}
}
if (!scan_result->Result.pvIes) {
if (is_ies_malloced) {
/* Locally allocated */
qdf_mem_free(local_ies);
}