From 0815318dec042885b85de6ff4aedbf7e92c3ff3e Mon Sep 17 00:00:00 2001 From: Kapil Gupta Date: Thu, 22 Dec 2016 14:59:25 +0530 Subject: qcacld-3.0: Fix invalid memory access issue in wma_tx_packet tpSirMacFrameCtl points to tx_frame however after deletion of tx_packet, tpSirMacFrameCtl pointer is not updated which is causing invalid memory access. Add changes to update tpSirMacFrameCtl once tx_frame got deleted. Change-Id: Ifb10899f0a518a935641af88a7ef45b0a6fd293c CRs-Fixed: 1103839 --- core/wma/src/wma_data.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/core/wma/src/wma_data.c b/core/wma/src/wma_data.c index 9ff8c041e268..f735a8afc68f 100644 --- a/core/wma/src/wma_data.c +++ b/core/wma/src/wma_data.c @@ -2546,7 +2546,6 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen, WMA_LOGE("No Support to send other frames except 802.11 Mgmt/Data"); return QDF_STATUS_E_FAILURE; } - mHdr = (tpSirMacMgmtHdr)qdf_nbuf_data(tx_frame); #ifdef WLAN_FEATURE_11W if ((iface && iface->rmfEnabled) && (frmType == TXRX_FRM_802_11_MGMT) && @@ -2590,6 +2589,8 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen, cds_packet_free((void *)tx_frame); tx_frame = pPacket; frmLen = newFrmLen; + pFc = (tpSirMacFrameCtl) + (qdf_nbuf_data(tx_frame)); } } else { /* Allocate extra bytes for MMIE */ @@ -2629,10 +2630,11 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen, cds_packet_free((void *)tx_frame); tx_frame = pPacket; frmLen = newFrmLen; + pFc = (tpSirMacFrameCtl) (qdf_nbuf_data(tx_frame)); } } #endif /* WLAN_FEATURE_11W */ - + mHdr = (tpSirMacMgmtHdr)qdf_nbuf_data(tx_frame); if ((frmType == TXRX_FRM_802_11_MGMT) && (pFc->subType == SIR_MAC_MGMT_PROBE_RSP)) { uint64_t adjusted_tsf_le; -- cgit v1.2.3