commit 0f2c21f3da1d387334ad9b6ed03c5732d101fbcb
author Anand N Sunkad <c_asunka@qti.qualcomm.com> Fri Jun 05 16:07:28 2015 +0530
committer Satyanarayana Dash <c_sadash@qti.qualcomm.com> Mon Jun 08 19:12:40 2015 +0530
tree 321e8da24b95a0e6b85be1bceb6fa9b9f608631e
parent 7a95a1ead769c5ee4821ed972985a5527f229daa

wlan: Use proper puserData while invoking response callback

when FTM start fails because of NV download response timeout
and if user issued FTM command again, WDI state machine move to
Started state, as part of started state WDI_MainStartStarted
function invoke response callback with older puserdata, which
is freed in previous execution of response callbck so invoking
response callback function with older puserdata triggers for
double free which leads to crash.

To mitigate, make sure to pass proper puserdata to response
callback in Main StartStarted.

CRs-Fixed: 849242
Change-Id: I07cf8af5faa107c5076297c35e35ba977137b533

CORE/WDI/CP/src/wlan_qct_wdi.c

diff --git a/CORE/WDI/CP/src/wlan_qct_wdi.c b/CORE/WDI/CP/src/wlan_qct_wdi.c
index 7fb1aac..7f46a28 100644
--- a/CORE/WDI/CP/src/wlan_qct_wdi.c
+++ b/CORE/WDI/CP/src/wlan_qct_wdi.c
@@ -7157,7 +7157,7 @@
   wdiStartRspCb = (WDI_StartRspCb)pEventData->pCBfnc;
 
    /*Notify UMAC*/
-  wdiStartRspCb( &pWDICtx->wdiCachedStartRspParams, pWDICtx->pRspCBUserData);
+  wdiStartRspCb( &pWDICtx->wdiCachedStartRspParams, pEventData->pUserData);
 
   /*Return Success*/
   return WDI_STATUS_SUCCESS;