qcacld-3.0: Avoid use after free in wma_vdev_detach_callback
If msg is failed to send, param is freed in wma_send_vdev_del_resp,
Use after free will happen in wma_vdev_detach_callback.
Change-Id: I4ebc2a2688566ff64ee2d56bb9508e7b81d6734b
CRs-Fixed: 2748421
diff --git a/core/wma/src/wma_dev_if.c b/core/wma/src/wma_dev_if.c
index e9761fa..67d2fa5 100644
--- a/core/wma/src/wma_dev_if.c
+++ b/core/wma/src/wma_dev_if.c
@@ -440,8 +440,10 @@
status = scheduler_post_message(QDF_MODULE_ID_WMA,
QDF_MODULE_ID_SME,
QDF_MODULE_ID_SME, &sme_msg);
- if (!QDF_IS_STATUS_SUCCESS(status))
+ if (!QDF_IS_STATUS_SUCCESS(status)) {
qdf_mem_free(param);
+ wma_err("Fail to send vdev del resp");
+ }
}
QDF_STATUS wma_vdev_detach_callback(struct vdev_delete_response *rsp)
@@ -491,7 +493,7 @@
param->status = QDF_STATUS_SUCCESS;
wma_send_vdev_del_resp(param);
- return param->status;
+ return QDF_STATUS_SUCCESS;
}
static void