A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 16:46:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix Use after free in wma_del_tdls_sta

Browse source 
The function wma_del_tdls_sta is used to process delete sta
request from UMAC in TDLS. peerStateParams is a pointer to the
structure tTdlsPeerStateParams. The memory allocated for
peerStateParams is freed in the call to the function
wma_update_tdls_peer_state(). When peerStateParams is used to
access vdev_id again after free, then a use after free case will
occur.

Retrieve the vdev_id value from the del_sta structure that is
passed into wma_del_tdls_sta initially.

Change-Id: Iad7edf87058bfc20aadc0e72d474b1c330790512
CRs-Fixed: 2216242
This commit is contained in:
Pragaspathi Thilagaraj 2018-04-11 17:09:28 +05:30 • committed by nshrivas
commit 78474348ae
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
core/wma/src/wma_dev_if.c
View file

@ -5143,9 +5143,9 @@ static void wma_del_tdls_sta(tp_wma_handle wma, tpDeleteStaParams del_sta)
WMA_DELETE_STA_TIMEOUT);
if (!msg) {
WMA_LOGE(FL("Failed to allocate vdev_id %d"),
peerStateParams->vdevId);
del_sta->smesessionId);
wma_remove_req(wma,
peerStateParams->vdevId,
del_sta->smesessionId,
WMA_DELETE_STA_RSP_START);
del_sta->status = QDF_STATUS_E_NOMEM;
goto send_del_rsp;