From aea5790657d66b7f2ce4a234df0871ca0930ff20 Mon Sep 17 00:00:00 2001 From: Abhishek Singh Date: Thu, 22 Apr 2021 12:03:54 +0530 Subject: [PATCH] qcacld-3.0: Avoid use after free of del_sta in wma_delete_sta In case of TDLS peer connected if SSR happen, LIM try to flush TDLS peer with del_sta->respReqd as false. With respReqd false del_sta is freed in the switch case, but is used outside the switch case, leading to use after free. Fix is to use the local vdev_id instead of del_sta->smesessionId. Change-Id: I7e08733cf42ef619b3fa0d6726ee1acc2012c6a4 CRs-Fixed: 2929448 --- core/wma/src/wma_dev_if.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/core/wma/src/wma_dev_if.c b/core/wma/src/wma_dev_if.c index 81abd4c4084c..d0267c5a004d 100644 --- a/core/wma/src/wma_dev_if.c +++ b/core/wma/src/wma_dev_if.c @@ -4794,7 +4794,7 @@ void wma_add_sta(tp_wma_handle wma, tpAddStaParams add_sta) void wma_delete_sta(tp_wma_handle wma, tpDeleteStaParams del_sta) { uint8_t oper_mode = BSS_OPERATIONAL_MODE_STA; - uint8_t smesession_id = del_sta->smesessionId; + uint8_t vdev_id = del_sta->smesessionId; bool rsp_requested = del_sta->respReqd; void *htc_handle; @@ -4804,18 +4804,17 @@ void wma_delete_sta(tp_wma_handle wma, tpDeleteStaParams del_sta) return; } - if (wma_is_vdev_in_ap_mode(wma, smesession_id)) + if (wma_is_vdev_in_ap_mode(wma, vdev_id)) oper_mode = BSS_OPERATIONAL_MODE_AP; if (del_sta->staType == STA_ENTRY_NDI_PEER) oper_mode = BSS_OPERATIONAL_MODE_NDI; - wma_debug("vdev %d oper_mode %d", del_sta->smesessionId, oper_mode); + wma_debug("vdev %d oper_mode %d", vdev_id, oper_mode); switch (oper_mode) { case BSS_OPERATIONAL_MODE_STA: - if (MLME_IS_ROAM_SYNCH_IN_PROGRESS(wma->psoc, smesession_id)) { - wma_debug("LFR3: Del STA on vdev_id %d", - del_sta->smesessionId); + if (MLME_IS_ROAM_SYNCH_IN_PROGRESS(wma->psoc, vdev_id)) { + wma_debug("LFR3: Del STA on vdev_id %d", vdev_id); qdf_mem_free(del_sta); return; } @@ -4844,7 +4843,7 @@ void wma_delete_sta(tp_wma_handle wma, tpDeleteStaParams del_sta) qdf_mem_free(del_sta); } - if (wma_is_vdev_in_sap_mode(wma, del_sta->smesessionId)) { + if (wma_is_vdev_in_sap_mode(wma, vdev_id)) { bool is_bus_suspend_allowed_in_sap_mode = (wlan_pmo_get_sap_mode_bus_suspend(wma->psoc) && wmi_service_enabled(wma->wmi_handle, @@ -4860,7 +4859,7 @@ void wma_delete_sta(tp_wma_handle wma, tpDeleteStaParams del_sta) return; } - if (wma_is_vdev_in_go_mode(wma, del_sta->smesessionId)) { + if (wma_is_vdev_in_go_mode(wma, vdev_id)) { bool is_bus_suspend_allowed_in_go_mode = (wlan_pmo_get_go_mode_bus_suspend(wma->psoc) && wmi_service_enabled(wma->wmi_handle,