From e92d91f8df7b4b883becbff99da4aead11112ba5 Mon Sep 17 00:00:00 2001
From: Kapil Gupta <kapgupta@codeaurora.org>
Date: Thu, 22 Dec 2016 14:59:25 +0530
Subject: [PATCH] qcacld-3.0: Fix invalid memory access issue in wma_tx_packet

tpSirMacFrameCtl points to tx_frame however after deletion of
tx_packet, tpSirMacFrameCtl pointer is not updated which is
causing invalid memory access.

Add changes to update tpSirMacFrameCtl once tx_frame got deleted.

Change-Id: Ifb10899f0a518a935641af88a7ef45b0a6fd293c
CRs-Fixed: 1103839
---
 core/wma/src/wma_data.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/core/wma/src/wma_data.c b/core/wma/src/wma_data.c
index 13b722cccd52..33c4e1b8c9b7 100644
--- a/core/wma/src/wma_data.c
+++ b/core/wma/src/wma_data.c
@@ -2476,7 +2476,6 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 		WMA_LOGE("No Support to send other frames except 802.11 Mgmt/Data");
 		return QDF_STATUS_E_FAILURE;
 	}
-	mHdr = (tpSirMacMgmtHdr)qdf_nbuf_data(tx_frame);
 #ifdef WLAN_FEATURE_11W
 	if ((iface && iface->rmfEnabled) &&
 	    (frmType == TXRX_FRM_802_11_MGMT) &&
@@ -2521,6 +2520,8 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 				tx_frame = pPacket;
 				pData = pFrame;
 				frmLen = newFrmLen;
+				pFc = (tpSirMacFrameCtl)
+						(qdf_nbuf_data(tx_frame));
 			}
 		} else {
 			/* Allocate extra bytes for MMIE */
@@ -2561,10 +2562,11 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 			tx_frame = pPacket;
 			pData = pFrame;
 			frmLen = newFrmLen;
+			pFc = (tpSirMacFrameCtl) (qdf_nbuf_data(tx_frame));
 		}
 	}
 #endif /* WLAN_FEATURE_11W */
-
+	mHdr = (tpSirMacMgmtHdr)qdf_nbuf_data(tx_frame);
 	if ((frmType == TXRX_FRM_802_11_MGMT) &&
 	    (pFc->subType == SIR_MAC_MGMT_PROBE_RSP)) {
 		uint64_t adjusted_tsf_le;