From db4d958ba46bddbe32e837542ee0bb21ee74da4e Mon Sep 17 00:00:00 2001 From: wadesong Date: Wed, 20 Dec 2017 15:28:34 +0800 Subject: [PATCH] qcacld-3.0: Refine peer object cleanup sequence When a peer object is to be removed in WLAN HDD object manager code, it should be logically deleted first before it's ref count is decreased and the peer object is freed, or there will be a potential race condition, in which a freed peer object buffer will be accessed. Change-Id: Ib3179e8207d1e9bbaa9c2b8450a8016e23cfc3f3 CRs-Fixed: 2161627 --- core/hdd/src/wlan_hdd_object_manager.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/hdd/src/wlan_hdd_object_manager.c b/core/hdd/src/wlan_hdd_object_manager.c index 9c090951c4f8..a87d63887220 100644 --- a/core/hdd/src/wlan_hdd_object_manager.c +++ b/core/hdd/src/wlan_hdd_object_manager.c @@ -346,11 +346,11 @@ int hdd_objmgr_remove_peer_object(struct wlan_objmgr_vdev *vdev, peer = wlan_objmgr_get_peer(psoc, mac_addr, WLAN_HDD_ID_OBJ_MGR); if (peer) { + wlan_objmgr_peer_obj_delete(peer); + /* Unref to decrement ref happened in find_peer */ wlan_objmgr_peer_release_ref(peer, WLAN_HDD_ID_OBJ_MGR); - wlan_objmgr_peer_obj_delete(peer); - hdd_info("Peer obj "MAC_ADDRESS_STR" deleted", MAC_ADDR_ARRAY(mac_addr)); return 0;