From b537de965001d5d30866f1cb986d66f3f04728ec Mon Sep 17 00:00:00 2001 From: Bapiraju Alla Date: Fri, 18 Dec 2020 17:55:12 +0530 Subject: [PATCH] qcacld-3.0: Flush previous cac work before starting a new pre cac Currently, previous pre_cac work is not being flushed before starting a new pre_cac work. This may result in use after free access if a new pre_cac request comes when cleanup in progress for previous pre_cac work. To avoid this, flush existing pre_cac work before handling a new pre_cac request. Change-Id: I2da535acce8b4a097214597bbc2169ca5521db57 CRs-Fixed: 2841644 --- core/hdd/src/wlan_hdd_hostapd.c | 1 - core/hdd/src/wlan_hdd_sap_cond_chan_switch.c | 10 ++++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/core/hdd/src/wlan_hdd_hostapd.c b/core/hdd/src/wlan_hdd_hostapd.c index 8ae00d461806..9f6c47faf811 100644 --- a/core/hdd/src/wlan_hdd_hostapd.c +++ b/core/hdd/src/wlan_hdd_hostapd.c @@ -1133,7 +1133,6 @@ static void __wlan_hdd_sap_pre_cac_success(struct hdd_adapter *adapter) return; } - wlan_hdd_release_intf_addr(hdd_ctx, adapter->mac_addr.bytes); hdd_stop_adapter(hdd_ctx, adapter); /* Prepare to switch AP from 2.4GHz channel to the pre CAC channel */ diff --git a/core/hdd/src/wlan_hdd_sap_cond_chan_switch.c b/core/hdd/src/wlan_hdd_sap_cond_chan_switch.c index e8c6d4323c78..b90dbc73c1f6 100644 --- a/core/hdd/src/wlan_hdd_sap_cond_chan_switch.c +++ b/core/hdd/src/wlan_hdd_sap_cond_chan_switch.c @@ -179,6 +179,14 @@ static int __wlan_hdd_request_pre_cac(struct hdd_context *hdd_ctx, mac_handle_t mac_handle; bool val; + pre_cac_adapter = hdd_get_adapter_by_iface_name(hdd_ctx, + SAP_PRE_CAC_IFNAME); + if (pre_cac_adapter) { + /* Flush existing pre_cac work */ + if (hdd_ctx->sap_pre_cac_work.fn) + cds_flush_work(&hdd_ctx->sap_pre_cac_work); + } + if (policy_mgr_get_connection_count(hdd_ctx->psoc) > 1) { hdd_err("pre cac not allowed in concurrency"); return -EINVAL; @@ -227,8 +235,6 @@ static int __wlan_hdd_request_pre_cac(struct hdd_context *hdd_ctx, hdd_debug("starting pre cac SAP adapter"); - pre_cac_adapter = hdd_get_adapter_by_iface_name(hdd_ctx, - SAP_PRE_CAC_IFNAME); if (!pre_cac_adapter) { mac_addr = wlan_hdd_get_intf_addr(hdd_ctx, QDF_SAP_MODE); if (!mac_addr) {