Android 13.0.0 release 0.31
bcmdhd: Fixed use-after-free error
[Issue]
KFENCE reported a use-after-free error in wl_cellavoid_do_csa_work()
[Analysis]
wl_cellavoid_free_csa_info() frees all wl_cellavoid_csa_info_t in linked list from cellavoid_info if csa_info is matched
after freeing csa_info, try to access csa_info->chanspec to log error.
It is obviously use-after-free.
Fixed not to access csa_info->chanspec after freeing csa_info.
Bug: 238987289
Test: build pass, basic function works fine
Signed-off-by: Dennis Jeon <dennis.jeon@broadcom.corp-partner.google.com>
Change-Id: Ie6f55a045ff366f41a8bc04937daa159c11789d5
1 file changed