commit ee43674b4a62f395ddf0779a519731afb3a02485
author Ajit Vaishya <ajitv@codeaurora.org> Fri Sep 27 20:35:20 2019 +0530
committer Jimmy Chen <jimmycmchen@google.com> Wed Oct 02 10:19:09 2019 +0800
tree 33c2e88f3ff23a1620fc15a2011c11c781fd7148
parent 855928e2e026da633ade6bfbfef0c80adbb0b674

Wifi-Hal: Clear received pointer on completion of Nan handle Event

Currently after processing of back to back Nan Event i.e.
QCA_NL80211_VENDOR_SUBCMD_NAN and QCA_NL80211_VENDOR_SUBCMD_NDP,
mNanVendorEvent is not clear properly. Due to this stale entry
of mNanVendorEvent been accessing.
Clear stale entry of mNanVendorEvent on completion of processing of Nan
Event.

Fixes: 141010724
Bug: 141010724
Test: CtsNetTestCases with hwasan
CRs-Fixed: 2537045
Change-Id: I1342924d8da6f275ca0c1b4e043470a4f0680ac4

qcwcn/wifi_hal/nan.cpp

diff --git a/qcwcn/wifi_hal/nan.cpp b/qcwcn/wifi_hal/nan.cpp
index 549b381..ac378fa 100644
--- a/qcwcn/wifi_hal/nan.cpp
+++ b/qcwcn/wifi_hal/nan.cpp
@@ -1260,6 +1260,7 @@
         //error case should not happen print log
         ALOGE("%s: Wrong NAN subcmd received %d", __FUNCTION__, mSubcmd);
     }
+    mNanVendorEvent = NULL;
     return NL_SKIP;
 }
 

qcwcn/wifi_hal/nan_rsp.cpp

diff --git a/qcwcn/wifi_hal/nan_rsp.cpp b/qcwcn/wifi_hal/nan_rsp.cpp
index 721ab49..f0b9b1c 100644
--- a/qcwcn/wifi_hal/nan_rsp.cpp
+++ b/qcwcn/wifi_hal/nan_rsp.cpp
@@ -350,7 +350,7 @@
     char tlvInfo[NAN_ERROR_STR_LEN];
     tlvInfo[0] = '\0';
 
-    if (isNanResponse() || (is_ndp_rsp == true)){
+    if ((is_ndp_rsp == true) || isNanResponse()) {
         pRsp = (NanResponseMsg*)pResponse;
         for (i = 0; i < (int)(sizeof(errorCodeTranslation)/ sizeof(errorCode)); i++) {
             if (errorCodeTranslation[i].firmwareError == firmwareErrorRecvd) {