commit 2e068bc626d4ee984c14d3979aa9c3dd2e5bced8
author Madan Mohan Koyyalamudi <c_mkoyya@qca.qualcomm.com> Mon Oct 22 14:58:47 2012 -0700
committer Jeff Johnson <jjohnson@qca.qualcomm.com> Fri Nov 30 14:54:58 2012 -0800
tree 222912de5da746c6c43b2682bac3aaad6c6d13f7
parent 3528786070077b4e90412db0edccb27f08219a86

wlan: Do not access free pointers while aging out scan entries

Fix the use-after-free bug discovered in csrApiScan.c

Change-Id: I4e5a7ae34fdac8691b74ab3fa08d00db3c12b589
CR-Fixed: 411302

CORE/SME/src/csr/csrApiScan.c

diff --git a/CORE/SME/src/csr/csrApiScan.c b/CORE/SME/src/csr/csrApiScan.c
index 22e7af1..bf04413 100644
--- a/CORE/SME/src/csr/csrApiScan.c
+++ b/CORE/SME/src/csr/csrApiScan.c
@@ -4578,13 +4578,13 @@
                 if( csrLLRemoveEntry(&pMac->scan.scanResultList, &pResult->Link, LL_ACCESS_NOLOCK) )
                 {
                     csrFreeScanResultEntry(pMac, pResult);
+                    fRet = eANI_BOOLEAN_TRUE;
                 }
-                fRet = eANI_BOOLEAN_TRUE;
                 break;
             }
         } //valid session
     } //for
-    if( CSR_ROAM_SESSION_MAX == i )
+    if( CSR_ROAM_SESSION_MAX == i && fRet != eANI_BOOLEAN_TRUE )
     {
         //reset the counter so this won't hapeen too soon
         pResult->AgingCount = (tANI_S32)pMac->roam.configParam.agingCount;