From 118f53494f403b59ccde6ba6cac0a7cd8bc3d6e3 Mon Sep 17 00:00:00 2001 From: Sravan Kumar Kairam Date: Fri, 12 Oct 2018 16:05:27 +0530 Subject: [PATCH] qcacmn: Return error for HAL src ring next entry desc is NULL In rx defrag reo inject frame when next hop and cached tail pointer becomes equal src ring next entry desc returned will be NULL. There is no NULL check and NULL pointer is dereferenced. In this change add NULL check and return error status when the next entry desc is NULL. Change-Id: I79ca6ba6e6501f03c0c5d188780745b6931102fe CRs-Fixed: 2318701 --- dp/wifi3.0/dp_rx_defrag.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/dp/wifi3.0/dp_rx_defrag.c b/dp/wifi3.0/dp_rx_defrag.c index 93cdfced1c1a..eef9ffb0e1e4 100644 --- a/dp/wifi3.0/dp_rx_defrag.c +++ b/dp/wifi3.0/dp_rx_defrag.c @@ -977,6 +977,13 @@ dp_rx_defrag_nwifi_to_8023(qdf_nbuf_t nbuf, uint16_t hdrsize) peer->rx_tid[tid].dst_ring_desc; void *hal_srng = soc->reo_reinject_ring.hal_srng; + ent_ring_desc = hal_srng_src_get_next(soc->hal_soc, hal_srng); + if (!ent_ring_desc) { + QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR, + "HAL src ring next entry NULL"); + return QDF_STATUS_E_FAILURE; + } + hal_rx_reo_buf_paddr_get(dst_ring_desc, &buf_info); link_desc_va = dp_rx_cookie_2_link_desc_va(soc, &buf_info); @@ -1028,7 +1035,6 @@ dp_rx_defrag_nwifi_to_8023(qdf_nbuf_t nbuf, uint16_t hdrsize) if (qdf_unlikely(ret == QDF_STATUS_E_FAILURE)) { QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR, "%s: nbuf map failed !", __func__); - qdf_nbuf_free(head); return QDF_STATUS_E_FAILURE; } @@ -1053,15 +1059,11 @@ dp_rx_defrag_nwifi_to_8023(qdf_nbuf_t nbuf, uint16_t hdrsize) return QDF_STATUS_E_FAILURE; } - ent_ring_desc = hal_srng_src_get_next(soc->hal_soc, hal_srng); - - qdf_assert(ent_ring_desc); - paddr = (uint64_t)buf_info.paddr; /* buf addr */ hal_rxdma_buff_addr_info_set(ent_ring_desc, paddr, - buf_info.sw_cookie, - HAL_RX_BUF_RBM_WBM_IDLE_DESC_LIST); + buf_info.sw_cookie, + HAL_RX_BUF_RBM_WBM_IDLE_DESC_LIST); /* mpdu desc info */ ent_mpdu_desc_info = (uint8_t *)ent_ring_desc + RX_MPDU_DETAILS_2_RX_MPDU_DESC_INFO_RX_MPDU_DESC_INFO_DETAILS_OFFSET;