diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c index beb41e895122..bb36214c1592 100644 --- a/core/wma/src/wma_utils.c +++ b/core/wma/src/wma_utils.c @@ -2456,6 +2456,12 @@ static void wma_vdev_stats_lost_link_helper(tp_wma_handle wma, static const uint8_t zero_mac[QDF_MAC_ADDR_SIZE] = {0}; int32_t bcn_snr, dat_snr; + if (vdev_stats->vdev_id >= wma->max_bssid) { + WMA_LOGE("%s: Invalid vdev_id %hu", + __func__, vdev_stats->vdev_id); + return; + } + node = &wma->interfaces[vdev_stats->vdev_id]; if (wma_is_vdev_up(vdev_stats->vdev_id) && !qdf_mem_cmp(node->bssid, zero_mac, QDF_MAC_ADDR_SIZE)) { @@ -2505,6 +2511,12 @@ static void wma_update_vdev_stats(tp_wma_handle wma, struct scheduler_msg sme_msg = { 0 }; int32_t bcn_snr, dat_snr; + if (vdev_stats->vdev_id >= wma->max_bssid) { + WMA_LOGE("%s: Invalid vdev_id %hu", + __func__, vdev_stats->vdev_id); + return; + } + bcn_snr = vdev_stats->vdev_snr.bcn_snr; dat_snr = vdev_stats->vdev_snr.dat_snr; WMA_LOGD("vdev id %d beancon snr %d data snr %d", @@ -2776,6 +2788,12 @@ static void wma_update_rssi_stats(tp_wma_handle wma, uint32_t temp_mask; uint8_t vdev_id; + if (rssi_stats->vdev_id >= wma->max_bssid) { + WMA_LOGE("%s: Invalid vdev_id %hu", + __func__, rssi_stats->vdev_id); + return; + } + vdev_id = rssi_stats->vdev_id; node = &wma->interfaces[vdev_id]; stats_rsp_params = (tAniGetPEStatsRsp *) node->stats_rsp;