qcacld-3.0: fix a double-free in ipa uc ready callback
hdd_ipa_uc_loaded_uc_cb() allocates a msg buffer and passes it to
workqueue handler. Both hdd_ipa_uc_loaded_uc_cb() and workqueue
handler free the msg buffer, which leads to wrong memory dereference.
Fix is to return directly in hdd_ipa_uc_loaded_uc_cb() and let workqueue
handler free the msg buffer.
Change-Id: I842700e7fe94dc9a77fba966d918a054bc79f36a
CRs-Fixed: 2069189
diff --git a/core/hdd/src/wlan_hdd_ipa.c b/core/hdd/src/wlan_hdd_ipa.c
index d9fe1f0..b477766 100644
--- a/core/hdd/src/wlan_hdd_ipa.c
+++ b/core/hdd/src/wlan_hdd_ipa.c
@@ -699,6 +699,9 @@
uc_op_work->msg = msg;
schedule_work(&uc_op_work->work);
+ /* work handler will free the msg buffer */
+ return;
+
done:
qdf_mem_free(msg);
}
@@ -2348,6 +2351,7 @@
if (HDD_IPA_UC_OPCODE_MAX <= msg->op_code) {
HDD_IPA_LOG(QDF_TRACE_LEVEL_ERROR,
"%s, INVALID OPCODE %d", __func__, msg->op_code);
+ qdf_mem_free(op_msg);
return;
}