From b9c4674fdaf48483ee911a30a485d7ea05377f5e Mon Sep 17 00:00:00 2001 From: Pragaspathi Thilagaraj Date: Fri, 13 Apr 2018 18:53:50 +0530 Subject: [PATCH] qcacld-3.0: Fix Use after free in wma_vdev_start_resp_handler In the function wma_vdev_start_resp_handler when we recieve a vdev start response event, we copy the req_msg->user_data to the object hidden_ssid_restart of the structure tpHalHiddenSsidVdevRestart. If hidden_ssid_restart_in_progress flag is set for the corresponding vdev_id, then we post that message to the PE and free the hidden_ssid_restart. If this req_msg->user_data is used again if req_msg->msg_type is WMA_CHNL_SWITCH_REQ , then a possible Use-After-Free will occur in wma_vdev_start_resp_handler. When a channel switch request has occured, there will not be a hidden ssid restart event in progress. So add check to validate if the req_msg->msg_type == WMA_HIDDEN_SSID_VDEV_RESTART. Change-Id: Ie3195b23ff136fbfd38fcd4d32e993d4cb016316 CRs-Fixed: 2216751 --- core/wma/src/wma_dev_if.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/core/wma/src/wma_dev_if.c b/core/wma/src/wma_dev_if.c index 4a641a184a2d..8bcf88ef11a2 100644 --- a/core/wma/src/wma_dev_if.c +++ b/core/wma/src/wma_dev_if.c @@ -1214,7 +1214,8 @@ int wma_vdev_start_resp_handler(void *handle, uint8_t *cmd_param_info, if ((resp_event->vdev_id < wma->max_bssid) && (qdf_atomic_read( &wma->interfaces[resp_event->vdev_id].vdev_restart_params.hidden_ssid_restart_in_progress)) - && (wma_is_vdev_in_ap_mode(wma, resp_event->vdev_id) == true)) { + && (wma_is_vdev_in_ap_mode(wma, resp_event->vdev_id) == true) + && (req_msg->msg_type == WMA_HIDDEN_SSID_VDEV_RESTART)) { tpHalHiddenSsidVdevRestart hidden_ssid_restart = (tpHalHiddenSsidVdevRestart)req_msg->user_data; WMA_LOGE("%s: vdev restart event recevied for hidden ssid set using IOCTL",