Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8973e4a8 authored by Abhishek Singh's avatar Abhishek Singh Committed by Gerrit - the friendly Code Review server
Browse files

qcacld-3.0: Avoid use after free of del_sta in wma_delete_sta 

In case of TDLS peer connected if SSR happen, LIM try to flush
TDLS peer with del_sta->respReqd as false.

With respReqd false del_sta is freed in the switch case, but
is used outside the switch case, leading to use after free.

Fix is to use the local vdev_id instead of del_sta->smesessionId.

Change-Id: I7e08733cf42ef619b3fa0d6726ee1acc2012c6a4
CRs-Fixed: 2929448
parent eadbd64f

core/wma/src/wma_dev_if.c

+7 −8
Original line number Diff line number Diff line
@@ -4794,7 +4794,7 @@ void wma_add_sta(tp_wma_handle wma, tpAddStaParams add_sta) 
void wma_delete_sta(tp_wma_handle wma, tpDeleteStaParams del_sta)

{

	uint8_t oper_mode = BSS_OPERATIONAL_MODE_STA;

	uint8_t smesession_id = del_sta->smesessionId;

	uint8_t vdev_id = del_sta->smesessionId;

	bool rsp_requested = del_sta->respReqd;

	void *htc_handle;
@@ -4804,18 +4804,17 @@ void wma_delete_sta(tp_wma_handle wma, tpDeleteStaParams del_sta) 
		return;

	}



	if (wma_is_vdev_in_ap_mode(wma, smesession_id))

	if (wma_is_vdev_in_ap_mode(wma, vdev_id))

		oper_mode = BSS_OPERATIONAL_MODE_AP;

	if (del_sta->staType == STA_ENTRY_NDI_PEER)

		oper_mode = BSS_OPERATIONAL_MODE_NDI;



	wma_debug("vdev %d oper_mode %d", del_sta->smesessionId, oper_mode);

	wma_debug("vdev %d oper_mode %d", vdev_id, oper_mode);



	switch (oper_mode) {

	case BSS_OPERATIONAL_MODE_STA:

		if (MLME_IS_ROAM_SYNCH_IN_PROGRESS(wma->psoc, smesession_id)) {

			wma_debug("LFR3: Del STA on vdev_id %d",

				  del_sta->smesessionId);

		if (MLME_IS_ROAM_SYNCH_IN_PROGRESS(wma->psoc, vdev_id)) {

			wma_debug("LFR3: Del STA on vdev_id %d", vdev_id);

			qdf_mem_free(del_sta);

			return;

		}
@@ -4844,7 +4843,7 @@ void wma_delete_sta(tp_wma_handle wma, tpDeleteStaParams del_sta) 
		qdf_mem_free(del_sta);

	}



	if (wma_is_vdev_in_sap_mode(wma, del_sta->smesessionId)) {

	if (wma_is_vdev_in_sap_mode(wma, vdev_id)) {

		bool is_bus_suspend_allowed_in_sap_mode =

			(wlan_pmo_get_sap_mode_bus_suspend(wma->psoc) &&

				wmi_service_enabled(wma->wmi_handle,
@@ -4860,7 +4859,7 @@ void wma_delete_sta(tp_wma_handle wma, tpDeleteStaParams del_sta) 
		return;

	}



	if (wma_is_vdev_in_go_mode(wma, del_sta->smesessionId)) {

	if (wma_is_vdev_in_go_mode(wma, vdev_id)) {

		bool is_bus_suspend_allowed_in_go_mode =

			(wlan_pmo_get_go_mode_bus_suspend(wma->psoc) &&

				wmi_service_enabled(wma->wmi_handle,