qcacld-3.0: Avoid use-after-free in mlo_roam_copy_reassoc_rsp

In mlo_roam_copy_reassoc_rsp(), assoc_rsp is a pointer inside
copied_reassoc_rsp incase of memory allocation for assoc_rsp,
copied_reassoc_rsp is getting freed but in the same error leg
"connect_ies->assoc_rsp.len" is getting set to 0 resulting in
use-after-free

Remove the code in the error handling to avoid use-after-free.

Change-Id: I5a7b3bbef42db4e8bedba0c7c3eaf961e4d7e83a
CRs-Fixed: 3728493
This commit is contained in:
Arun Kumar Khandavalli
2024-02-09 15:06:30 +05:30
zatwierdzone przez Ravindra Konda
rodzic 06aa01c3bc
commit b5d052ed4c

Wyświetl plik

@@ -1056,7 +1056,6 @@ mlo_roam_copy_reassoc_rsp(struct wlan_objmgr_vdev *vdev,
sta_ctx->copied_reassoc_rsp->roaming_info = NULL;
qdf_mem_free(sta_ctx->copied_reassoc_rsp);
sta_ctx->copied_reassoc_rsp = NULL;
connect_ies->assoc_rsp.len = 0;
return QDF_STATUS_E_NOMEM;
}