A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 15:11:48 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: fix use after free issue: avoid access nbuf after deliver to OS

Browse source 
stats update is reading nbuf after vdev->osif_rx

Change-Id: I1d1972979066b402e4ee0519596cd305c5895702
This commit is contained in:
Neil Zhao 2018-11-27 15:16:19 -08:00 • committed by nshrivas
commit fca0919fb9
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
dp/wifi3.0/dp_rx_err.c
View file

@ -818,7 +818,7 @@ dp_rx_null_q_desc_handle(struct dp_soc *soc, qdf_nbuf_t nbuf,
qdf_nbuf_set_next(nbuf, NULL);
DP_STATS_INC_PKT(peer, rx.to_stack, 1,
qdf_nbuf_len(nbuf));
vdev->osif_rx(vdev->osif_vdev, nbuf);
if (qdf_unlikely(hal_rx_msdu_end_da_is_mcbc_get(
rx_tlv_hdr) &&
(vdev->rx_decap_type ==
@ -832,6 +832,9 @@ dp_rx_null_q_desc_handle(struct dp_soc *soc, qdf_nbuf_t nbuf,
qdf_nbuf_len(nbuf));
}
}
vdev->osif_rx(vdev->osif_vdev, nbuf);
} else {
QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
FL("INVALID vdev %pK OR osif_rx"), vdev);