Sfoglia il codice sorgente

qcacld-3.0: Fix usage of PDEV pointer after free

Currently pdev pointer is freed prematurely in ol_txrx_pdev_pre_detach
but the same pointer is used when ol_txrx_pdev_detach is called. This
may lead to invalid pointer dereference issue.

To fix this issue, free pdev pointer in ol_txrx_pdev_detach after
ol_txrx_pdev_pre_detach is called.

Change-Id: I089d70842b90b568ee8a38c6ed56f5418df7303d
CRs-Fixed: 2207417
Alok Kumar 7 anni fa
parent
commit
ddd457e4a3
1 ha cambiato i file con 2 aggiunte e 1 eliminazioni
  1. 2 1
      core/dp/txrx/ol_txrx.c

+ 2 - 1
core/dp/txrx/ol_txrx.c

@@ -2073,7 +2073,6 @@ static void ol_txrx_pdev_pre_detach(struct cdp_pdev *ppdev, int force)
 #ifdef QCA_COMPUTE_TX_DELAY
 	qdf_spinlock_destroy(&pdev->tx_delay.mutex);
 #endif
-	qdf_mem_free(ppdev);
 }
 
 /**
@@ -2142,6 +2141,8 @@ static void ol_txrx_pdev_detach(struct cdp_pdev *ppdev, int force)
 
 	ol_txrx_pdev_txq_log_destroy(pdev);
 	ol_txrx_pdev_grp_stat_destroy(pdev);
+
+	qdf_mem_free(pdev);
 }
 
 #if defined(CONFIG_PER_VDEV_TX_DESC_POOL)