From ddd457e4a3023702b79f97669d8b1cf94c3a0104 Mon Sep 17 00:00:00 2001 From: Alok Kumar Date: Mon, 9 Apr 2018 13:51:42 +0530 Subject: [PATCH] qcacld-3.0: Fix usage of PDEV pointer after free Currently pdev pointer is freed prematurely in ol_txrx_pdev_pre_detach but the same pointer is used when ol_txrx_pdev_detach is called. This may lead to invalid pointer dereference issue. To fix this issue, free pdev pointer in ol_txrx_pdev_detach after ol_txrx_pdev_pre_detach is called. Change-Id: I089d70842b90b568ee8a38c6ed56f5418df7303d CRs-Fixed: 2207417 --- core/dp/txrx/ol_txrx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/core/dp/txrx/ol_txrx.c b/core/dp/txrx/ol_txrx.c index f8094ce92887..7c87da93051f 100644 --- a/core/dp/txrx/ol_txrx.c +++ b/core/dp/txrx/ol_txrx.c @@ -2073,7 +2073,6 @@ static void ol_txrx_pdev_pre_detach(struct cdp_pdev *ppdev, int force) #ifdef QCA_COMPUTE_TX_DELAY qdf_spinlock_destroy(&pdev->tx_delay.mutex); #endif - qdf_mem_free(ppdev); } /** @@ -2142,6 +2141,8 @@ static void ol_txrx_pdev_detach(struct cdp_pdev *ppdev, int force) ol_txrx_pdev_txq_log_destroy(pdev); ol_txrx_pdev_grp_stat_destroy(pdev); + + qdf_mem_free(pdev); } #if defined(CONFIG_PER_VDEV_TX_DESC_POOL)