diff options
| author | Dustin Brown <dustinb@codeaurora.org> | 2017-10-13 11:51:06 -0700 |
|---|---|---|
| committer | Dustin Brown <dustinb@codeaurora.org> | 2017-10-13 11:51:06 -0700 |
| commit | 203409107b98d64b20a4cc03026b83d6d46d1733 (patch) | |
| tree | d255487f0b6adae4d77ea25c5e2d2dba2026067e | |
| parent | af7dca013f7181f5f29364eec0dcb6f4c3668905 (diff) | |
qcacld-3.0: Fix use-after-free in fw event processor
wmi_process_fw_event() frees the given buffer after it has been
processed. A recent change reaches into this buffer to get the EventId,
leading to a use-after-free. Instead, extract the EventId before
processing the event.
Change-Id: I8147ac62629c07ce27271a2cec8e5ab6a88393ff
CRs-Fixed: 2126580
| -rw-r--r-- | core/wma/src/wma_main.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/core/wma/src/wma_main.c b/core/wma/src/wma_main.c index 1c219335795f..8b937addecbd 100644 --- a/core/wma/src/wma_main.c +++ b/core/wma/src/wma_main.c @@ -1615,12 +1615,11 @@ static int wma_process_fw_event(tp_wma_handle wma, wma_process_fw_event_params *buf) { struct wmi_unified *wmi_handle = (struct wmi_unified *)buf->wmi_handle; - uint32_t event_id; + uint32_t event_id = WMI_GET_FIELD(qdf_nbuf_data(buf->evt_buf), + WMI_CMD_HDR, COMMANDID); wmi_process_fw_event(wmi_handle, buf->evt_buf); - event_id = WMI_GET_FIELD(qdf_nbuf_data(buf->evt_buf), - WMI_CMD_HDR, COMMANDID); if (wma_event_is_critical(event_id)) qdf_atomic_dec(&wma->critical_events_in_flight); @@ -1724,7 +1723,6 @@ static int wma_process_fw_event_mc_thread_ctx(void *ctx, void *ev) return -EFAULT; } return 0; - } /** |