From 2131384024c0420cd1aef22f48b53104b978cb8a Mon Sep 17 00:00:00 2001 From: Jingxiang Ge Date: Tue, 10 Mar 2020 12:48:48 +0800 Subject: [PATCH] qcacld-3.0: Fix sta_info use after free in hdd_softap_stop_bss In hdd_softap_deregister_sta, cdp_clear_peer may return fail as peer has been deleted in other path, but the free of sta_info will be continue. So in hdd_softap_stop_bss, it will still access mac address from sta_info, which will cause use after free. Fix: Even cdp_clear_peer return failure, it is expected, so only log but not return failure to caller function. In hdd_softap_stop_bss, remove mac address info log as in hdd_softap_deregister_sta, there has been enough log for each failure case. Change-Id: Id06c78cb8d215488eb34d8412359ac2d684756d5 CRs-Fixed: 2637287 --- core/hdd/src/wlan_hdd_softap_tx_rx.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/core/hdd/src/wlan_hdd_softap_tx_rx.c b/core/hdd/src/wlan_hdd_softap_tx_rx.c index 0f86e3c7e2ec..96b0aadc3bb0 100644 --- a/core/hdd/src/wlan_hdd_softap_tx_rx.c +++ b/core/hdd/src/wlan_hdd_softap_tx_rx.c @@ -1010,7 +1010,7 @@ QDF_STATUS hdd_softap_deregister_sta(struct hdd_adapter *adapter, ucfg_mlme_update_oce_flags(hdd_ctx->pdev); - return qdf_status; + return QDF_STATUS_SUCCESS; } QDF_STATUS hdd_softap_register_sta(struct hdd_adapter *adapter, @@ -1194,11 +1194,6 @@ QDF_STATUS hdd_softap_stop_bss(struct hdd_adapter *adapter) hdd_for_each_station_safe(adapter->sta_info_list, sta_info, index, tmp) { status = hdd_softap_deregister_sta(adapter, &sta_info); - - if (QDF_IS_STATUS_ERROR(status) && sta_info) - hdd_debug("Deregistering STA " QDF_MAC_ADDR_STR - " failed", - QDF_MAC_ADDR_ARRAY(sta_info->sta_mac.bytes)); } if (adapter->device_mode == QDF_SAP_MODE &&