diff options
| author | Kapil Gupta <kapgupta@codeaurora.org> | 2016-12-22 14:59:25 +0530 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2016-12-29 13:23:26 -0800 |
| commit | 0815318dec042885b85de6ff4aedbf7e92c3ff3e (patch) | |
| tree | 0975299c31290e87209cbd1233d4f8f2c8d0ebf3 | |
| parent | f6ed7ba8b6ce23d1c8611dcb05e564457170edb2 (diff) | |
qcacld-3.0: Fix invalid memory access issue in wma_tx_packet
tpSirMacFrameCtl points to tx_frame however after deletion of
tx_packet, tpSirMacFrameCtl pointer is not updated which is
causing invalid memory access.
Add changes to update tpSirMacFrameCtl once tx_frame got deleted.
Change-Id: Ifb10899f0a518a935641af88a7ef45b0a6fd293c
CRs-Fixed: 1103839
| -rw-r--r-- | core/wma/src/wma_data.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/core/wma/src/wma_data.c b/core/wma/src/wma_data.c index 9ff8c041e268..f735a8afc68f 100644 --- a/core/wma/src/wma_data.c +++ b/core/wma/src/wma_data.c @@ -2546,7 +2546,6 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen, WMA_LOGE("No Support to send other frames except 802.11 Mgmt/Data"); return QDF_STATUS_E_FAILURE; } - mHdr = (tpSirMacMgmtHdr)qdf_nbuf_data(tx_frame); #ifdef WLAN_FEATURE_11W if ((iface && iface->rmfEnabled) && (frmType == TXRX_FRM_802_11_MGMT) && @@ -2590,6 +2589,8 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen, cds_packet_free((void *)tx_frame); tx_frame = pPacket; frmLen = newFrmLen; + pFc = (tpSirMacFrameCtl) + (qdf_nbuf_data(tx_frame)); } } else { /* Allocate extra bytes for MMIE */ @@ -2629,10 +2630,11 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen, cds_packet_free((void *)tx_frame); tx_frame = pPacket; frmLen = newFrmLen; + pFc = (tpSirMacFrameCtl) (qdf_nbuf_data(tx_frame)); } } #endif /* WLAN_FEATURE_11W */ - + mHdr = (tpSirMacMgmtHdr)qdf_nbuf_data(tx_frame); if ((frmType == TXRX_FRM_802_11_MGMT) && (pFc->subType == SIR_MAC_MGMT_PROBE_RSP)) { uint64_t adjusted_tsf_le; |