Pārlūkot izejas kodu

qcacld-3.0: Fix use after free of HDD context

HDD context is freed as part of wiphy_free() kernel API call
and after it any access of HDD context member variable will
lead to use after panic. Make sure to destroy iface change
mutex before HDD context is freed as part of wiphy_free.

Change-Id: Ic447501c8c7faad7cc7322e5fdb112cb74e5d7ad
CRs-Fixed: 2169505
Rajeev Kumar 7 gadi atpakaļ
vecāks
revīzija
fa55a6954b
1 mainītis faili ar 1 papildinājumiem un 1 dzēšanām
  1. 1 1
      core/hdd/src/wlan_hdd_main.c

+ 1 - 1
core/hdd/src/wlan_hdd_main.c

@@ -8220,8 +8220,8 @@ err_free_config:
 	qdf_mem_free(hdd_ctx->config);
 
 err_free_hdd_context:
-	wiphy_free(hdd_ctx->wiphy);
 	mutex_destroy(&hdd_ctx->iface_change_lock);
+	wiphy_free(hdd_ctx->wiphy);
 
 err_out:
 	return ERR_PTR(ret);