From 49d21a4c888d2d2bca70ffc9cdbca1ff0a6e116e Mon Sep 17 00:00:00 2001 From: "Chandrasekaran, Manishekar" Date: Thu, 19 Nov 2015 09:57:58 +0530 Subject: [PATCH] qcacld-3.0: Reset global saved command to avoid double free Reset the global saved scan command to avoid double free. In sme_process_set_hw_mode_resp(), after freeing the local saved_cmd pointer, the global mac->sme.saved_scan_cmd is not reset to NULL. This ends up in double free in csr_scan_complete()->csr_handle_nxt_cmd() where we are still holding a stale pointer. CRs-Fixed: 941130 Change-Id: Ibb93b8d8e601936c7996518f21646e2c140cbd20 --- core/sme/src/common/sme_api.c | 1 + 1 file changed, 1 insertion(+) diff --git a/core/sme/src/common/sme_api.c b/core/sme/src/common/sme_api.c index f4cc8df95029..f91b44ca8982 100644 --- a/core/sme/src/common/sme_api.c +++ b/core/sme/src/common/sme_api.c @@ -228,6 +228,7 @@ static CDF_STATUS sme_process_set_hw_mode_resp(tpAniSirGlobal mac, uint8_t *msg) if (saved_cmd) { cdf_mem_free(saved_cmd); saved_cmd = NULL; + mac->sme.saved_scan_cmd = NULL; } } else { sms_log(mac, LOGE,