A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 16:46:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix pointer dereference condition

Browse source 
In the API csr_roam_read_tsf, the driver assigns
pBssDescription to handoffNode.pBssDescription but
it may happen that handoffNode.pBssDescription was NULL,
which would result in a pointer dereference.

Fix is to assign pBssDescription, and perform related
operation with pBssDescription after valid check for
handoffNode.pBssDescription.

Change-Id: I2b9ff44e22aa86b1430d8a624bac2f0e50b91738
CRs-Fixed: 2259253
This commit is contained in:
gaurank kathpalia 2018-07-03 11:45:06 +05:30 • committed by nshrivas
commit 2b6f50708a
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
core/sme/src/csr/csr_api_roam.c
View file

@ -2190,6 +2190,10 @@ QDF_STATUS csr_roam_read_tsf(tpAniSirGlobal pMac, uint8_t *pTimestamp,
tpSirBssDescription pBssDescription = NULL;
csr_neighbor_roam_get_handoff_ap_info(pMac, &handoffNode, sessionId);
if (!handoffNode.pBssDescription) {
sme_err("Invalid BSS Description");
return QDF_STATUS_E_INVAL;
}
pBssDescription = handoffNode.pBssDescription;
/* Get the time diff in nano seconds */
timer_diff = (qdf_get_monotonic_boottime_ns() -