commit fff0f9ef3f9d072d0ad2be6c36048a7f75f59b38
author Sreelakshmi Konamki <c_skonam@qti.qualcomm.com> Wed Jul 20 15:02:28 2016 +0530
committer Satyanarayana Dash <sadash@codeaurora.org> Tue Jul 26 17:43:08 2016 +0530
tree 65dacbe27fe69bc7cbe2650dcc87ba602f81841f
parent a91e6c389f3da72be9b3103fd226e77fe9763795

wlan: Avoid dereference of pointer after free

Fix to avoid dereference of pointer after free and
initialize pointer before use.

Change-Id: I845f02b3f513b7fb202def187a3b87624b1cd236
CRs-Fixed: 1041573

CORE/MAC/src/pe/lim/limProcessMessageQueue.c

diff --git a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
index 1930dcf..d7cb4b1 100644
--- a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
+++ b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
@@ -2252,7 +2252,7 @@
         {
             tpPESession     psessionEntry;
             tANI_U8         sessionId;
-            tDphHashNode   *pStaDs;
+            tDphHashNode   *pStaDs = NULL;
             int i, aid;
             tTdlsLinkEstablishParams *pTdlsLinkEstablishParams;
             pTdlsLinkEstablishParams = (tTdlsLinkEstablishParams*) limMsg->bodyptr;
@@ -2289,11 +2289,17 @@
                     }
                 }
 send_link_resp:
-                limSendSmeTdlsLinkEstablishReqRsp(pMac,
+                if (pStaDs)
+                   limSendSmeTdlsLinkEstablishReqRsp(pMac,
                                                   psessionEntry->smeSessionId,
                                                   pStaDs->staAddr,
                                                   pStaDs,
                                                   pTdlsLinkEstablishParams->status) ;
+                else
+                   limSendSmeTdlsLinkEstablishReqRsp(pMac,
+                                                  psessionEntry->smeSessionId,
+                                                  NULL, NULL,
+                                                  pTdlsLinkEstablishParams->status) ;
             }
             vos_mem_free((v_VOID_t *)(limMsg->bodyptr));
             limMsg->bodyptr = NULL;
@@ -2304,7 +2310,7 @@
         {
             tpPESession     psessionEntry;
             tANI_U8         sessionId;
-            tDphHashNode   *pStaDs;
+            tDphHashNode   *pStaDs = NULL;
             int i, aid;
             tTdlsChanSwitchParams *pTdlsChanSwitchParams;
             pTdlsChanSwitchParams = (tTdlsChanSwitchParams*) limMsg->bodyptr;
@@ -2341,11 +2347,17 @@
                     }
                 }
 send_chan_switch_resp:
-                limSendSmeTdlsChanSwitchReqRsp(pMac,
+                if (pStaDs)
+                    limSendSmeTdlsChanSwitchReqRsp(pMac,
                                                   psessionEntry->smeSessionId,
                                                   pStaDs->staAddr,
                                                   pStaDs,
-                                                  pTdlsChanSwitchParams->status) ;
+                                                  pTdlsChanSwitchParams->status);
+               else
+                    limSendSmeTdlsChanSwitchReqRsp(pMac,
+                                                  psessionEntry->smeSessionId,
+                                                  NULL, NULL,
+                                                  pTdlsChanSwitchParams->status);
             }
             vos_mem_free((v_VOID_t *)(limMsg->bodyptr));
             limMsg->bodyptr = NULL;

CORE/WDA/src/wlan_qct_wda.c

diff --git a/CORE/WDA/src/wlan_qct_wda.c b/CORE/WDA/src/wlan_qct_wda.c
index 57a008c..1685e02 100644
--- a/CORE/WDA/src/wlan_qct_wda.c
+++ b/CORE/WDA/src/wlan_qct_wda.c
@@ -14999,10 +14999,10 @@
                  FL("Fwr Mem Dump Req failed, free all the memory"));
        status = CONVERT_WDI2VOS_STATUS(wstatus);
        vos_mem_free(pWdaParams->wdaWdiApiMsgParam) ;
-       vos_mem_free(pWdaParams->wdaMsgParam);
-       vos_mem_free(pWdaParams);
        pWdaParams->wdaWdiApiMsgParam = NULL;
+       vos_mem_free(pWdaParams->wdaMsgParam);
        pWdaParams->wdaMsgParam = NULL;
+       vos_mem_free(pWdaParams);
    }
 
     return status;