diff options
| author | Rajeev Kumar <rajekuma@qca.qualcomm.com> | 2015-09-04 12:11:31 -0700 |
|---|---|---|
| committer | Akash Patel <akashp@codeaurora.org> | 2015-09-04 14:01:11 -0700 |
| commit | 5fd79141a993b2b5fcbcbc9ad59dd34cd9ac88a6 (patch) | |
| tree | 31b9e8b2cdfd4621beb1b8aeae2fffa815898d4a | |
| parent | 42df485785363b1ea1b293f7dd65edfb8de313c4 (diff) | |
qcacld-2.0: Fix crash in scan path caused by use after free
- In WMA start scan command buffer is used after calling
WMI unified command send API
- WMI unified command send API internally takes care of freeing
command buffer once copy engine TX complete interrupt is received
- Since start scan command buffer is freed in WMI kernel complains
about WMA is still using freed pointer
- Fix this issue by caching vdev_id and scac_id before calling
WMI unified command send API
Change-Id: I3ac4aaf3c9bd5fc70dcaf4351287486814d8e4a9
CRs-Fixed: 901871
| -rw-r--r-- | CORE/SERVICES/WMA/wma.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c index 631831b60f1e..88ada99b225f 100644 --- a/CORE/SERVICES/WMA/wma.c +++ b/CORE/SERVICES/WMA/wma.c @@ -8301,6 +8301,7 @@ static VOS_STATUS wma_reset_tsf_gpio(tp_wma_handle wma_handle, uint32_t vdev_id) VOS_STATUS wma_start_scan(tp_wma_handle wma_handle, tSirScanOffloadReq *scan_req, v_U16_t msg_type) { + uint32_t vdev_id, scan_id; VOS_STATUS vos_status = VOS_STATUS_SUCCESS; wmi_buf_t buf = NULL; wmi_start_scan_cmd_fixed_param *cmd; @@ -8367,6 +8368,13 @@ VOS_STATUS wma_start_scan(tp_wma_handle wma_handle, cmd->scan_id, cmd->vdev_id, scan_req->p2pScanType, msg_type); + /* + * Cache vdev_id and scan_id because cmd is freed after calling + * wmi_unified_cmd_send cmd. WMI internally frees cmd buffer after + * getting TX complete from CE + */ + vdev_id = cmd->vdev_id; + scan_id = cmd->scan_id; status = wmi_unified_cmd_send(wma_handle->wmi_handle, buf, len, WMI_START_SCAN_CMDID); /* Call the wmi api to request the scan */ @@ -8380,8 +8388,8 @@ VOS_STATUS wma_start_scan(tp_wma_handle wma_handle, WMA_LOGI("WMA --> WMI_START_SCAN_CMDID"); /* Update the scan parameters for handler */ - wma_handle->wma_scan_timer_info.vdev_id = cmd->vdev_id; - wma_handle->wma_scan_timer_info.scan_id = cmd->scan_id; + wma_handle->wma_scan_timer_info.vdev_id = vdev_id; + wma_handle->wma_scan_timer_info.scan_id = scan_id; return VOS_STATUS_SUCCESS; error: |