From 2b6f50708a1083fcd2bf19f2713dd5d218f15fc9 Mon Sep 17 00:00:00 2001 From: gaurank kathpalia Date: Tue, 3 Jul 2018 11:45:06 +0530 Subject: [PATCH] qcacld-3.0: Fix pointer dereference condition In the API csr_roam_read_tsf, the driver assigns pBssDescription to handoffNode.pBssDescription but it may happen that handoffNode.pBssDescription was NULL, which would result in a pointer dereference. Fix is to assign pBssDescription, and perform related operation with pBssDescription after valid check for handoffNode.pBssDescription. Change-Id: I2b9ff44e22aa86b1430d8a624bac2f0e50b91738 CRs-Fixed: 2259253 --- core/sme/src/csr/csr_api_roam.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c index ebd0ab8eaf81..e7d4b767b0d2 100644 --- a/core/sme/src/csr/csr_api_roam.c +++ b/core/sme/src/csr/csr_api_roam.c @@ -2190,6 +2190,10 @@ QDF_STATUS csr_roam_read_tsf(tpAniSirGlobal pMac, uint8_t *pTimestamp, tpSirBssDescription pBssDescription = NULL; csr_neighbor_roam_get_handoff_ap_info(pMac, &handoffNode, sessionId); + if (!handoffNode.pBssDescription) { + sme_err("Invalid BSS Description"); + return QDF_STATUS_E_INVAL; + } pBssDescription = handoffNode.pBssDescription; /* Get the time diff in nano seconds */ timer_diff = (qdf_get_monotonic_boottime_ns() -