In sme_qos_del_ts_req, there is a chance that driver can access del ts req pMsg even after free. In umac_send_mb_message_to_mac driver frees pMsg if there is some failure. But driver still tries to access pMsg in sme_qos_del_ts_req even if umac_send_mb_ message_to_mac returns failure. Access pMsg only if umac_send_mb_message_to_mac returns success to avoid this use after free issue. Change-Id: I3638a38746b9cd917e01a7ff6f38430344e6e78d CRs-Fixed: 2214718 |
||
---|---|---|
.. | ||
inc | ||
src |