A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 08:07:32 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Remove use-after-free of frame in tx mgmt send

Browse source 
The tx completion handler for the frame frees the buffer.
Therefore, usage of frame after tx completion causes undesired
effect.

Remove the dereference of tx frame buffer contents in
lim_tx_mgmt_frame() after the tx completion.

Mot-CRs-fixed: (CR)
CVE- fixed: CVE-2024-33069

Change-Id: I32211e1bce4f96ba920a2212ef65aa39831666ab
CRs-Fixed: 3772014
(cherry picked from commit 2b66fcb567197854c43d8323de564b2949dfb8f5)
Signed-off-by: Dharshan R <dharshan@motorola.com>
Reviewed-on: https://gerrit.mot.com/3073982
SME-Granted: SME Approvals Granted
SLTApproved: Slta Waiver
Tested-by: Jira Key
Reviewed-by: Varun Shrivastava <varunshrivastava@motorola.com>
Reviewed-by: Daniel Finimundi <danielrf@motorola.com>
Submit-Approved: Jira Key
This commit is contained in:
Surya Prakash Sivaraj 2024-03-29 10:33:08 +05:30 • committed by PDO SCM Team
commit 4249d3fa5f
1 changed files with 1 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
core/mac/src/pe/lim/lim_send_management_frames.c
View file

@ -5744,8 +5744,7 @@ static void lim_tx_mgmt_frame(struct mac_context *mac_ctx, uint8_t vdev_id,
MTRACE(qdf_trace(QDF_MODULE_ID_PE, TRACE_CODE_TX_COMPLETE,
session->peSessionId, qdf_status));
if (!QDF_IS_STATUS_SUCCESS(qdf_status)) {
pe_err("*** Could not send Auth frame (subType: %d), retCode=%X ***",
fc->subType, qdf_status);
pe_err("Could not send Auth frame, retCode=%X", qdf_status);
mac_ctx->auth_ack_status = LIM_TX_FAILED;
auth_ack_status = SENT_FAIL;
lim_diag_event_report(mac_ctx, WLAN_PE_DIAG_AUTH_ACK_EVENT,