A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-24 21:54:34 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Avoid NULL pointer dereference in lim_send_auth_mgmt_frame

Browse source 
pLimJoinReq will be NULL for the pe session, created when
STA does a successful FT-Preauth with target AP, using LFR
2.0 based roaming.
Any subsequent roaming using this new pe session will cause NULL
pointer dereference.
Hence checking validity of session->pLimJoinReq before accessing.

Change-Id: I47480a4d22c02ce1cc804430f60e8adf7959164e
CRs-Fixed: 2433647
This commit is contained in:
nakul kachhwaha 2019-04-25 14:55:02 +05:30 • committed by nshrivas
commit 088df27098
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
core/mac/src/pe/lim/lim_send_management_frames.c
View file

@ -2394,7 +2394,8 @@ lim_send_auth_mgmt_frame(struct mac_context *mac_ctx,
}
/* include MDIE in FILS authentication frame */
if (session->pLimJoinReq->is11Rconnection &&
if (session->pLimJoinReq &&
session->pLimJoinReq->is11Rconnection &&
auth_frame->authAlgoNumber == SIR_FILS_SK_WITHOUT_PFS &&
session->pLimJoinReq->bssDescription.mdiePresent)
frame_len += (2 + SIR_MDIE_SIZE);