A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 16:46:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix usage of PDEV pointer after free

Browse source 
Currently pdev pointer is freed prematurely in ol_txrx_pdev_pre_detach
but the same pointer is used when ol_txrx_pdev_detach is called. This
may lead to invalid pointer dereference issue.

To fix this issue, free pdev pointer in ol_txrx_pdev_detach after
ol_txrx_pdev_pre_detach is called.

Change-Id: I089d70842b90b568ee8a38c6ed56f5418df7303d
CRs-Fixed: 2207417
This commit is contained in:
Alok Kumar 2018-04-09 13:51:42 +05:30 • committed by nshrivas
commit ddd457e4a3
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
core/dp/txrx/ol_txrx.c
View file

@ -2073,7 +2073,6 @@ static void ol_txrx_pdev_pre_detach(struct cdp_pdev *ppdev, int force)
#ifdef QCA_COMPUTE_TX_DELAY
qdf_spinlock_destroy(&pdev->tx_delay.mutex);
#endif
qdf_mem_free(ppdev);
}
/**
@ -2142,6 +2141,8 @@ static void ol_txrx_pdev_detach(struct cdp_pdev *ppdev, int force)
ol_txrx_pdev_txq_log_destroy(pdev);
ol_txrx_pdev_grp_stat_destroy(pdev);
qdf_mem_free(pdev);
}
#if defined(CONFIG_PER_VDEV_TX_DESC_POOL)