diff options
| author | Rakesh Pillai <pillair@codeaurora.org> | 2018-06-08 17:20:14 +0530 |
|---|---|---|
| committer | Rakesh Pillai <pillair@codeaurora.org> | 2018-06-08 17:21:40 +0530 |
| commit | cf1353d02a5d4e6e071fb25f3839067b7512cc1b (patch) | |
| tree | 215fabae194e7028e5f139e38dc07c9aacad15eb | |
| parent | 076ea10f280267dd83dfe75b1580048c9a4f989c (diff) | |
qcacld-2.0: Fix Use-After-Free in ol_txrx_pdev_detach
The use TAILQ_FOREACH for freeing the fw_stats list during
pdev detach causes a use-after-free condition, which can lead
to unexpected behavior during the driver load or unload.
Fix the possible Use-after-free condition in pdev detach, by
using TAILQ_FOREACH_SAFE instead of TAILQ_FOREACH for freeing
the fw_stats list.
CRs-Fixed: 2257124
Change-Id: I5dfcc5e3f0d2e77a5f6226eca06bc6ab1af4e643
| -rw-r--r-- | CORE/CLD_TXRX/TXRX/ol_txrx.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/CORE/CLD_TXRX/TXRX/ol_txrx.c b/CORE/CLD_TXRX/TXRX/ol_txrx.c index e251c79b93c4..21efd282a241 100644 --- a/CORE/CLD_TXRX/TXRX/ol_txrx.c +++ b/CORE/CLD_TXRX/TXRX/ol_txrx.c @@ -903,7 +903,7 @@ void ol_txrx_pdev_detach(ol_txrx_pdev_handle pdev, int force) { int i = 0; - struct ol_txrx_stats_req_internal *req; + struct ol_txrx_stats_req_internal *req, *temp_req; /*checking to ensure txrx pdev structure is not NULL */ if (!pdev) { @@ -922,7 +922,7 @@ ol_txrx_pdev_detach(ol_txrx_pdev_handle pdev, int force) "Warning: the txrx req list is not empty, depth=%d\n", pdev->req_list_depth ); - TAILQ_FOREACH(req, &pdev->req_list, req_list_elem) { + TAILQ_FOREACH_SAFE(req, &pdev->req_list, req_list_elem, temp_req) { TAILQ_REMOVE(&pdev->req_list, req, req_list_elem); pdev->req_list_depth--; TXRX_PRINT(TXRX_PRINT_LEVEL_ERR, |