A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-11-09 12:24:07 -05:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix possible double free in lim_handle_delete_bss_rsp

Browse source 
When disconnect is issued from userspace, lim_del_bss is invoked
and vdev stop is sent to firmware. If sending vdev stop fails,
WMA_DELETE_BSS_RSP is posted with failure. If an SSR is
happening during this time, then cds_mc_thread is preempted, and
as part of the pld uevent vdev resp queue cleanup is done . In
this path, lim_process_sta_mlm_del_bss_rsp is called and
msg->bodyptr is freed and pe session is deleted. After pld
uevent execution, the delete bss response processing in
cds_mc_thread as part of user space disconnect resumes and tries
to free the msg->bodyptr again. This results in double free.

Add check to validate if msg->bodyptr is NULL before freeing
the memory.

Change-Id: I491e5bab640aca6546b58755502dd00aa1bc6083
CRs-Fixed: 2324482
This commit is contained in:
Pragaspathi Thilagaraj 2018-10-09 17:30:13 +05:30 • committed by nshrivas
commit 986ddbe853
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
View file

@ -2224,7 +2224,10 @@ void lim_handle_delete_bss_rsp(tpAniSirGlobal pMac, struct scheduler_msg *MsgQ)
if (psessionEntry == NULL) {
pe_err("Session Does not exist for given sessionID: %d",
pDelBss->sessionId);
qdf_mem_free(MsgQ->bodyptr);
if (MsgQ->bodyptr) {
qdf_mem_free(MsgQ->bodyptr);
MsgQ->bodyptr = NULL;
}
return;
}