A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 07:37:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: fix a potential access after free

Browse source 
Once the wmi command is send to the FW, a sequence of events
(deletion of peer and sending of unmap messages to host) happens
on FW. This could potentially make a subsequent access to peer_addr
an access after the object is freed. Indeed a crash instance of
such a case has been reported.
Fix this by moving the print command before the actual wmi command
send.

Change-Id: I5a0d19b9b4a09687d5513acc52139a73b8490512
CRs-Fixed: 1108700
This commit is contained in:
Orhan K AKYILDIZ 2017-01-10 14:32:18 -08:00 • committed by qcabuildsw
commit 547ec52872
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
wmi/src/wmi_unified_tlv.c
View file

@ -499,12 +499,12 @@ QDF_STATUS send_peer_delete_cmd_tlv(wmi_unified_t wmi,
WMI_CHAR_ARRAY_TO_MAC_ADDR(peer_addr, &cmd->peer_macaddr);
cmd->vdev_id = vdev_id;
WMI_LOGD("%s: peer_addr %pM vdev_id %d", __func__, peer_addr, vdev_id);
if (wmi_unified_cmd_send(wmi, buf, len, WMI_PEER_DELETE_CMDID)) {
WMI_LOGP("%s: Failed to send peer delete command", __func__);
wmi_buf_free(buf);
return QDF_STATUS_E_FAILURE;
}
WMI_LOGD("%s: peer_addr %pM vdev_id %d", __func__, peer_addr, vdev_id);
return 0;
}