From 1dead6f99e993e3756848331fe555116bca48bfe Mon Sep 17 00:00:00 2001 From: chenguo Date: Mon, 8 Jan 2018 14:51:44 +0800 Subject: [PATCH] qcacmn: Fix pointer dereference after memory free The pointer to peer is dereferenced after memory free in peer _unref_delete function. Fix the issue by changing function call sequence. CRs-Fixed: 2167698 Change-Id: Iebd8f958bde4964c16a3c312d037e8f06e319350 --- dp/wifi3.0/dp_main.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/dp/wifi3.0/dp_main.c b/dp/wifi3.0/dp_main.c index db176b9347e7..05fb56e639b7 100644 --- a/dp/wifi3.0/dp_main.c +++ b/dp/wifi3.0/dp_main.c @@ -3683,6 +3683,11 @@ void dp_peer_unref_delete(void *peer_handle) } else { qdf_spin_unlock_bh(&soc->peer_ref_mutex); } + + if (soc->cdp_soc.ol_ops->peer_unref_delete) { + soc->cdp_soc.ol_ops->peer_unref_delete(pdev->osif_pdev, + vdev->vdev_id, peer->mac_addr.raw); + } #ifdef notyet qdf_mempool_free(soc->osdev, soc->mempool_ol_ath_peer, peer); #else @@ -3695,11 +3700,6 @@ void dp_peer_unref_delete(void *peer_handle) free_peer: qdf_mem_free(peer); #endif - if (soc->cdp_soc.ol_ops->peer_unref_delete) { - soc->cdp_soc.ol_ops->peer_unref_delete(pdev->osif_pdev, - vdev->vdev_id, peer->mac_addr.raw); - } - } else { qdf_spin_unlock_bh(&soc->peer_ref_mutex); }