A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-25 22:23:14 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix double free in csr_roaming_state_config_cnf_processor

Browse source 
The beacon ie of AP to connect in sme cmd may be freed and set to
NULL in csr_roam if csr_roam_issue_join failed,
scan_result->Result.pvIes may be different in start and end of
csr_roaming_state_config_cnf_processor.

Fixed by using a local bool val to mark whether beacon ie is new
malloced and need free.

Change-Id: I04ec952273a28a3b8a215dd6812bba213ff5309a
CRs-Fixed: 2284311
This commit is contained in:
Jianmin Zhu 2018-07-26 19:40:25 +08:00 • committed by nshrivas
commit a0d8e00d02
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
core/sme/src/csr/csr_api_roam.c
View file

@ -9912,6 +9912,7 @@ csr_roaming_state_config_cnf_processor(tpAniSirGlobal mac_ctx,
uint32_t session_id;
struct csr_roam_session *session;
tDot11fBeaconIEs *local_ies = NULL;
bool is_ies_malloced = false;
QDF_STATUS status = QDF_STATUS_E_FAILURE;
if (NULL == cmd) {
@ -10021,6 +10022,7 @@ csr_roaming_state_config_cnf_processor(tpAniSirGlobal mac_ctx,
&local_ies);
if (!QDF_IS_STATUS_SUCCESS(status))
return;
is_ies_malloced = true;
}
if (csr_is_conn_state_connected_infra(mac_ctx, session_id)) {
@ -10090,7 +10092,7 @@ csr_roaming_state_config_cnf_processor(tpAniSirGlobal mac_ctx,
csr_roam(mac_ctx, cmd);
}
}
if (!scan_result->Result.pvIes) {
if (is_ies_malloced) {
/* Locally allocated */
qdf_mem_free(local_ies);
}