Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit b0527b3f authored by Surya Prakash Sivaraj's avatar Surya Prakash Sivaraj Committed by Michael Bestas
Browse files

qcacld-3.0: Remove use-after-free of frame in tx mgmt send 

The tx completion handler for the frame frees the buffer.
Therefore, usage of frame after tx completion causes undesired
effect.

Remove the dereference of tx frame buffer contents in
lim_tx_mgmt_frame() after the tx completion.

Change-Id: I32211e1bce4f96ba920a2212ef65aa39831666ab
CRs-Fixed: 3772014
parent b8b3179c

drivers/staging/qcacld-3.0/core/mac/src/pe/lim/lim_send_management_frames.c

+1 −3
Original line number Diff line number Diff line
@@ -5416,7 +5416,6 @@ QDF_STATUS lim_send_delba_action_frame(struct mac_context *mac_ctx, 
static void lim_tx_mgmt_frame(struct mac_context *mac_ctx, uint8_t vdev_id,

			      uint32_t msg_len, void *packet, uint8_t *frame)

{

	tpSirMacFrameCtl fc = (tpSirMacFrameCtl)frame;

	QDF_STATUS qdf_status;

	struct pe_session *session;

	uint16_t auth_ack_status;
@@ -5445,8 +5444,7 @@ static void lim_tx_mgmt_frame(struct mac_context *mac_ctx, uint8_t vdev_id, 
	MTRACE(qdf_trace(QDF_MODULE_ID_PE, TRACE_CODE_TX_COMPLETE,

		session->peSessionId, qdf_status));

	if (!QDF_IS_STATUS_SUCCESS(qdf_status)) {

		pe_err("*** Could not send Auth frame (subType: %d), retCode=%X ***",

			fc->subType, qdf_status);

		pe_err("Could not send Auth frame, retCode=%X", qdf_status);

		mac_ctx->auth_ack_status = LIM_TX_FAILED;

		auth_ack_status = SENT_FAIL;

		lim_diag_event_report(mac_ctx, WLAN_PE_DIAG_AUTH_ACK_EVENT,