From a0d8e00d0271031044f370cb904a6113c581eaf5 Mon Sep 17 00:00:00 2001 From: Jianmin Zhu Date: Thu, 26 Jul 2018 19:40:25 +0800 Subject: [PATCH] qcacld-3.0: Fix double free in csr_roaming_state_config_cnf_processor The beacon ie of AP to connect in sme cmd may be freed and set to NULL in csr_roam if csr_roam_issue_join failed, scan_result->Result.pvIes may be different in start and end of csr_roaming_state_config_cnf_processor. Fixed by using a local bool val to mark whether beacon ie is new malloced and need free. Change-Id: I04ec952273a28a3b8a215dd6812bba213ff5309a CRs-Fixed: 2284311 --- core/sme/src/csr/csr_api_roam.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c index 28cb2693b3cd..91e763293087 100644 --- a/core/sme/src/csr/csr_api_roam.c +++ b/core/sme/src/csr/csr_api_roam.c @@ -9912,6 +9912,7 @@ csr_roaming_state_config_cnf_processor(tpAniSirGlobal mac_ctx, uint32_t session_id; struct csr_roam_session *session; tDot11fBeaconIEs *local_ies = NULL; + bool is_ies_malloced = false; QDF_STATUS status = QDF_STATUS_E_FAILURE; if (NULL == cmd) { @@ -10021,6 +10022,7 @@ csr_roaming_state_config_cnf_processor(tpAniSirGlobal mac_ctx, &local_ies); if (!QDF_IS_STATUS_SUCCESS(status)) return; + is_ies_malloced = true; } if (csr_is_conn_state_connected_infra(mac_ctx, session_id)) { @@ -10090,7 +10092,7 @@ csr_roaming_state_config_cnf_processor(tpAniSirGlobal mac_ctx, csr_roam(mac_ctx, cmd); } } - if (!scan_result->Result.pvIes) { + if (is_ies_malloced) { /* Locally allocated */ qdf_mem_free(local_ies); }