From 3cfca968de4ab68d9de825b35ee0375d5fba3d73 Mon Sep 17 00:00:00 2001 From: Harprit Chhabada Date: Tue, 4 Dec 2018 13:41:31 -0800 Subject: [PATCH] qcacld-3.0: Fix null pointer dereference for vdev_mac_entry In wma_process_pdev_hw_mode_trans_ind() vdev_mac_entry is used to copy the pdev_id and vdev_id values from a for loop. vdev_mac_entry is never checked before if it is allocated and can lead to null pointer dereference. Change-Id: I44ea6f5262bf39116af33a4d833a2c77d7963626 CRs-Fixed: 2359250 --- core/wma/src/wma_main.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/core/wma/src/wma_main.c b/core/wma/src/wma_main.c index 048f1f329df8..504954865107 100644 --- a/core/wma/src/wma_main.c +++ b/core/wma/src/wma_main.c @@ -4035,6 +4035,7 @@ void wma_process_pdev_hw_mode_trans_ind(void *handle, { uint32_t i; tp_wma_handle wma = (tp_wma_handle) handle; + if (fixed_param->num_vdev_mac_entries > MAX_VDEV_SUPPORTED) { WMA_LOGE("Number of Vdev mac entries %d exceeded" " max vdev supported %d", @@ -4051,6 +4052,11 @@ void wma_process_pdev_hw_mode_trans_ind(void *handle, fixed_param->new_hw_mode_index, fixed_param->num_vdev_mac_entries); + if (!vdev_mac_entry) { + WMA_LOGE("Invalid vdev_mac_entry"); + return; + } + /* Store the vdev-mac map in WMA and send to policy manager */ for (i = 0; i < fixed_param->num_vdev_mac_entries; i++) { uint32_t vdev_id, mac_id, pdev_id;