A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 15:11:48 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix null pointer dereference for vdev_mac_entry

Browse source 
In wma_process_pdev_hw_mode_trans_ind() vdev_mac_entry is used  to copy the
pdev_id and vdev_id values from a for loop.

vdev_mac_entry is never checked before if it is allocated and can lead to
null pointer dereference.

Change-Id: I44ea6f5262bf39116af33a4d833a2c77d7963626
CRs-Fixed: 2359250
This commit is contained in:
Harprit Chhabada 2018-12-04 13:41:31 -08:00 • committed by nshrivas
commit 3cfca968de
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
core/wma/src/wma_main.c
View file

@ -4035,6 +4035,7 @@ void wma_process_pdev_hw_mode_trans_ind(void *handle,
{
uint32_t i;
tp_wma_handle wma = (tp_wma_handle) handle;
if (fixed_param->num_vdev_mac_entries > MAX_VDEV_SUPPORTED) {
WMA_LOGE("Number of Vdev mac entries %d exceeded"
" max vdev supported %d",
@ -4051,6 +4052,11 @@ void wma_process_pdev_hw_mode_trans_ind(void *handle,
fixed_param->new_hw_mode_index,
fixed_param->num_vdev_mac_entries);
if (!vdev_mac_entry) {
WMA_LOGE("Invalid vdev_mac_entry");
return;
}
/* Store the vdev-mac map in WMA and send to policy manager */
for (i = 0; i < fixed_param->num_vdev_mac_entries; i++) {
uint32_t vdev_id, mac_id, pdev_id;