From 78474348ae3e632701283130161ce17c8591e1fa Mon Sep 17 00:00:00 2001 From: Pragaspathi Thilagaraj Date: Wed, 11 Apr 2018 17:09:28 +0530 Subject: [PATCH] qcacld-3.0: Fix Use after free in wma_del_tdls_sta The function wma_del_tdls_sta is used to process delete sta request from UMAC in TDLS. peerStateParams is a pointer to the structure tTdlsPeerStateParams. The memory allocated for peerStateParams is freed in the call to the function wma_update_tdls_peer_state(). When peerStateParams is used to access vdev_id again after free, then a use after free case will occur. Retrieve the vdev_id value from the del_sta structure that is passed into wma_del_tdls_sta initially. Change-Id: Iad7edf87058bfc20aadc0e72d474b1c330790512 CRs-Fixed: 2216242 --- core/wma/src/wma_dev_if.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/wma/src/wma_dev_if.c b/core/wma/src/wma_dev_if.c index ac0d2ead2997..c69e552f74b0 100644 --- a/core/wma/src/wma_dev_if.c +++ b/core/wma/src/wma_dev_if.c @@ -5143,9 +5143,9 @@ static void wma_del_tdls_sta(tp_wma_handle wma, tpDeleteStaParams del_sta) WMA_DELETE_STA_TIMEOUT); if (!msg) { WMA_LOGE(FL("Failed to allocate vdev_id %d"), - peerStateParams->vdevId); + del_sta->smesessionId); wma_remove_req(wma, - peerStateParams->vdevId, + del_sta->smesessionId, WMA_DELETE_STA_RSP_START); del_sta->status = QDF_STATUS_E_NOMEM; goto send_del_rsp;