A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 23:24:22 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix sta_info use after free in hdd_softap_stop_bss

Browse source 
In hdd_softap_deregister_sta, cdp_clear_peer may return fail
as peer has been deleted in other path, but the free of sta_info
will be continue.
So in hdd_softap_stop_bss, it will still access mac address
from sta_info, which will cause use after free.

Fix:
   Even cdp_clear_peer return failure, it is expected, so only
   log but not return failure to caller function.
   In hdd_softap_stop_bss, remove mac address info log as in
   hdd_softap_deregister_sta, there has been enough log for
   each failure case.

Change-Id: Id06c78cb8d215488eb34d8412359ac2d684756d5
CRs-Fixed: 2637287
This commit is contained in:
Jingxiang Ge 2020-03-10 12:48:48 +08:00 • committed by nshrivas
commit 2131384024
1 changed files with 1 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

7
core/hdd/src/wlan_hdd_softap_tx_rx.c
View file

@ -1010,7 +1010,7 @@ QDF_STATUS hdd_softap_deregister_sta(struct hdd_adapter *adapter,
ucfg_mlme_update_oce_flags(hdd_ctx->pdev);
return qdf_status;
return QDF_STATUS_SUCCESS;
}
QDF_STATUS hdd_softap_register_sta(struct hdd_adapter *adapter,
@ -1194,11 +1194,6 @@ QDF_STATUS hdd_softap_stop_bss(struct hdd_adapter *adapter)
hdd_for_each_station_safe(adapter->sta_info_list, sta_info,
index, tmp) {
status = hdd_softap_deregister_sta(adapter, &sta_info);
if (QDF_IS_STATUS_ERROR(status) && sta_info)
hdd_debug("Deregistering STA " QDF_MAC_ADDR_STR
" failed",
QDF_MAC_ADDR_ARRAY(sta_info->sta_mac.bytes));
}
if (adapter->device_mode == QDF_SAP_MODE &&