From 66dcb41eaa966dde9eb99d2a15cf4fe009600dac Mon Sep 17 00:00:00 2001 From: Tushnim Bhattacharyya Date: Fri, 12 Oct 2018 09:48:45 -0700 Subject: qcacld-3.0: Fix possible double free in lim_handle_delete_bss_rsp When disconnect is issued from userspace, lim_del_bss is invoked and vdev stop is sent to firmware. If sending vdev stop fails, WMA_DELETE_BSS_RSP is posted with failure. If an SSR is happening during this time, then cds_mc_thread is preempted, and as part of the pld uevent vdev resp queue cleanup is done . In this path, lim_process_sta_mlm_del_bss_rsp is called and msg->bodyptr is freed and pe session is deleted. After pld uevent execution, the delete bss response processing in cds_mc_thread as part of user space disconnect resumes and tries to free the msg->bodyptr again. This results in double free. Set msg->bodyptr to NULL after freeing the memory. Change-Id: I851a5ddcae47cffe450dffafa31570895620bd9c CRs-Fixed: 2332677 --- core/mac/src/pe/lim/lim_send_sme_rsp_messages.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) (limited to 'core/mac/src') diff --git a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c index fbba7473c912..f359621f24dd 100644 --- a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c +++ b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c @@ -2395,10 +2395,8 @@ void lim_handle_delete_bss_rsp(tpAniSirGlobal pMac, tpSirMsgQ MsgQ) if (psessionEntry == NULL) { pe_err("Session Does not exist for given sessionID: %d", pDelBss->sessionId); - if (MsgQ->bodyptr) { - qdf_mem_free(MsgQ->bodyptr); - MsgQ->bodyptr = NULL; - } + qdf_mem_free(MsgQ->bodyptr); + MsgQ->bodyptr = NULL; return; } -- cgit v1.2.3