samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: fix a potential access after free

Browse Source 
Once the wmi command is send to the FW, a sequence of events
(deletion of peer and sending of unmap messages to host) happens
on FW. This could potentially make a subsequent access to peer_addr
an access after the object is freed. Indeed a crash instance of
such a case has been reported.
Fix this by moving the print command before the actual wmi command
send.

Change-Id: I5a0d19b9b4a09687d5513acc52139a73b8490512
CRs-Fixed: 1108700
This commit is contained in:
Orhan K AKYILDIZ
2017-01-10 14:32:18 -08:00
committed by qcabuildsw
parent 33bb714364
commit c8d1c4bccf
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
wmi_unified_tlv.c
View File

@@ -499,12 +499,12 @@ QDF_STATUS send_peer_delete_cmd_tlv(wmi_unified_t wmi,
WMI_CHAR_ARRAY_TO_MAC_ADDR(peer_addr, &cmd->peer_macaddr);
cmd->vdev_id = vdev_id;
WMI_LOGD("%s: peer_addr %pM vdev_id %d", __func__, peer_addr, vdev_id);
if (wmi_unified_cmd_send(wmi, buf, len, WMI_PEER_DELETE_CMDID)) {
WMI_LOGP("%s: Failed to send peer delete command", __func__);
wmi_buf_free(buf);
return QDF_STATUS_E_FAILURE;
}
WMI_LOGD("%s: peer_addr %pM vdev_id %d", __func__, peer_addr, vdev_id);
return 0;
}