A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-23 21:19:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix pointer dereference after memory free

Browse source 
The pointer to peer is dereferenced after memory free in peer
_unref_delete function. Fix the issue by changing function
call sequence.

CRs-Fixed: 2167698
Change-Id: Iebd8f958bde4964c16a3c312d037e8f06e319350
This commit is contained in:
chenguo 2018-01-08 14:51:44 +08:00 • committed by snandini
commit 1dead6f99e
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
dp/wifi3.0/dp_main.c
View file

@ -3683,6 +3683,11 @@ void dp_peer_unref_delete(void *peer_handle)
} else {
qdf_spin_unlock_bh(&soc->peer_ref_mutex);
}
if (soc->cdp_soc.ol_ops->peer_unref_delete) {
soc->cdp_soc.ol_ops->peer_unref_delete(pdev->osif_pdev,
vdev->vdev_id, peer->mac_addr.raw);
}
#ifdef notyet
qdf_mempool_free(soc->osdev, soc->mempool_ol_ath_peer, peer);
#else
@ -3695,11 +3700,6 @@ void dp_peer_unref_delete(void *peer_handle)
free_peer:
qdf_mem_free(peer);
#endif
if (soc->cdp_soc.ol_ops->peer_unref_delete) {
soc->cdp_soc.ol_ops->peer_unref_delete(pdev->osif_pdev,
vdev->vdev_id, peer->mac_addr.raw);
}
} else {
qdf_spin_unlock_bh(&soc->peer_ref_mutex);
}