From 088df27098edf3b770da254f69786e0ba3f0e291 Mon Sep 17 00:00:00 2001 From: nakul kachhwaha Date: Thu, 25 Apr 2019 14:55:02 +0530 Subject: [PATCH] qcacld-3.0: Avoid NULL pointer dereference in lim_send_auth_mgmt_frame pLimJoinReq will be NULL for the pe session, created when STA does a successful FT-Preauth with target AP, using LFR 2.0 based roaming. Any subsequent roaming using this new pe session will cause NULL pointer dereference. Hence checking validity of session->pLimJoinReq before accessing. Change-Id: I47480a4d22c02ce1cc804430f60e8adf7959164e CRs-Fixed: 2433647 --- core/mac/src/pe/lim/lim_send_management_frames.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/core/mac/src/pe/lim/lim_send_management_frames.c b/core/mac/src/pe/lim/lim_send_management_frames.c index bbdf8d7a8af8..725c887a3795 100644 --- a/core/mac/src/pe/lim/lim_send_management_frames.c +++ b/core/mac/src/pe/lim/lim_send_management_frames.c @@ -2394,7 +2394,8 @@ lim_send_auth_mgmt_frame(struct mac_context *mac_ctx, } /* include MDIE in FILS authentication frame */ - if (session->pLimJoinReq->is11Rconnection && + if (session->pLimJoinReq && + session->pLimJoinReq->is11Rconnection && auth_frame->authAlgoNumber == SIR_FILS_SK_WITHOUT_PFS && session->pLimJoinReq->bssDescription.mdiePresent) frame_len += (2 + SIR_MDIE_SIZE);