From e14c24792e97d09617bce4e178e490b22dd22225 Mon Sep 17 00:00:00 2001 From: Sourav Mohapatra Date: Fri, 1 Nov 2019 09:29:16 +0530 Subject: [PATCH] qcacld-3.0: Use delete safe loop to remove sta info Presently, in hdd_reset_all_adapters, the removal of the sta_info structures via hdd_deregister_sta happens inside a loop that is not safe for removal. This can cause various potential invalid memory access from use-after-free to null-dereference. To rectify this, use the delete safe API to loop over the sta info entries. Change-Id: I3d5526af8d8f819874f6bcffabf27ceb74f6f32a CRs-Fixed: 2557364 --- core/hdd/src/wlan_hdd_main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/core/hdd/src/wlan_hdd_main.c b/core/hdd/src/wlan_hdd_main.c index 686b7fd28ed7..35c66eb55df9 100644 --- a/core/hdd/src/wlan_hdd_main.c +++ b/core/hdd/src/wlan_hdd_main.c @@ -6161,6 +6161,7 @@ QDF_STATUS hdd_reset_all_adapters(struct hdd_context *hdd_ctx) struct wlan_objmgr_vdev *vdev; uint8_t index = 0; struct hdd_station_info *sta_info; + struct hdd_sta_info_entry *tmp; hdd_enter(); @@ -6273,8 +6274,8 @@ QDF_STATUS hdd_reset_all_adapters(struct hdd_context *hdd_ctx) &adapter->event_flags); /* Loop over and deregister every registered peer */ - hdd_for_each_station(adapter->sta_info_list, sta_info, - index) { + hdd_for_each_station_safe(adapter->sta_info_list, + sta_info, index, tmp) { hdd_debug("[SSR] deregister STA MAC:" QDF_MAC_ADDR_STR, QDF_MAC_ADDR_ARRAY( sta_info->sta_mac.bytes));