From fa55a6954b323a0fc15d71bbc003e077613997dc Mon Sep 17 00:00:00 2001 From: Rajeev Kumar Date: Tue, 9 Jan 2018 14:12:41 -0800 Subject: [PATCH] qcacld-3.0: Fix use after free of HDD context HDD context is freed as part of wiphy_free() kernel API call and after it any access of HDD context member variable will lead to use after panic. Make sure to destroy iface change mutex before HDD context is freed as part of wiphy_free. Change-Id: Ic447501c8c7faad7cc7322e5fdb112cb74e5d7ad CRs-Fixed: 2169505 --- core/hdd/src/wlan_hdd_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/hdd/src/wlan_hdd_main.c b/core/hdd/src/wlan_hdd_main.c index adf65450064b..3abe089a6d64 100644 --- a/core/hdd/src/wlan_hdd_main.c +++ b/core/hdd/src/wlan_hdd_main.c @@ -8220,8 +8220,8 @@ err_free_config: qdf_mem_free(hdd_ctx->config); err_free_hdd_context: - wiphy_free(hdd_ctx->wiphy); mutex_destroy(&hdd_ctx->iface_change_lock); + wiphy_free(hdd_ctx->wiphy); err_out: return ERR_PTR(ret);