From 9e084cd5ad8a0ed72eda18adcff6a402ad1cd4d8 Mon Sep 17 00:00:00 2001 From: Bala Venkatesh Date: Tue, 25 Sep 2018 13:51:01 +0530 Subject: [PATCH] qcacmn: Fix double free of qdf idr Currently, As part of mgmt tx request qdf id is alloted and it is removed as part of mgmt tx cancel and the same idr value is stored in roc context and that idr is removed once again during roc context destroy that lead to double free of the same qdf idr. This will result in subsequent mgmt tx cancel failures. Dont remove qdf idr as part of mgmt tx cancel. Change-Id: I7c6f19f6d50e7f5eef216eedfa750f058dbc1ba6 CRs-Fixed: 2320990 --- umac/p2p/dispatcher/src/wlan_p2p_ucfg_api.c | 1 - 1 file changed, 1 deletion(-) diff --git a/umac/p2p/dispatcher/src/wlan_p2p_ucfg_api.c b/umac/p2p/dispatcher/src/wlan_p2p_ucfg_api.c index 563b1dc392f1..da0f423b90b3 100644 --- a/umac/p2p/dispatcher/src/wlan_p2p_ucfg_api.c +++ b/umac/p2p/dispatcher/src/wlan_p2p_ucfg_api.c @@ -402,7 +402,6 @@ QDF_STATUS ucfg_p2p_mgmt_tx_cancel(struct wlan_objmgr_psoc *soc, p2p_debug("invalid id"); return QDF_STATUS_E_INVAL; } - qdf_idr_remove(&p2p_soc_obj->p2p_idr, (int32_t)cookie); cancel_tx = qdf_mem_malloc(sizeof(*cancel_tx)); if (!cancel_tx) {