From fca0919fb9c488b26e246bbc3797103d84ab377e Mon Sep 17 00:00:00 2001
From: Neil Zhao <nwzhao@codeaurora.org>
Date: Tue, 27 Nov 2018 15:16:19 -0800
Subject: [PATCH] qcacmn: fix use after free issue: avoid access nbuf after
 deliver to OS

stats update is reading nbuf after vdev->osif_rx

Change-Id: I1d1972979066b402e4ee0519596cd305c5895702
---
 dp/wifi3.0/dp_rx_err.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/dp/wifi3.0/dp_rx_err.c b/dp/wifi3.0/dp_rx_err.c
index 6a38f74e0d24..798805db41a7 100644
--- a/dp/wifi3.0/dp_rx_err.c
+++ b/dp/wifi3.0/dp_rx_err.c
@@ -818,7 +818,7 @@ dp_rx_null_q_desc_handle(struct dp_soc *soc, qdf_nbuf_t nbuf,
 			qdf_nbuf_set_next(nbuf, NULL);
 			DP_STATS_INC_PKT(peer, rx.to_stack, 1,
 					 qdf_nbuf_len(nbuf));
-			vdev->osif_rx(vdev->osif_vdev, nbuf);
+
 			if (qdf_unlikely(hal_rx_msdu_end_da_is_mcbc_get(
 						rx_tlv_hdr) &&
 					 (vdev->rx_decap_type ==
@@ -832,6 +832,9 @@ dp_rx_null_q_desc_handle(struct dp_soc *soc, qdf_nbuf_t nbuf,
 							 qdf_nbuf_len(nbuf));
 				}
 			}
+
+			vdev->osif_rx(vdev->osif_vdev, nbuf);
+
 		} else {
 			QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
 				FL("INVALID vdev %pK OR osif_rx"), vdev);