A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 16:16:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix uninitialized variable use in cds_set_5g_channel_params

Browse source 
Initialize pointers bonded_chan_ptr and bonded_chan_ptr2 in function
with NULL and add check to avoid NULL/wild pointer dereference.

Change-Id: I48e4417998d75a7a42d6e55106896709016ac61c
CRs-Fixed: 1075098
This commit is contained in:
Arif Hussain 2016-10-06 13:35:57 -07:00 • committed by qcabuildsw
commit 4afc226c49
1 changed files with 16 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

27
core/cds/src/cds_reg_service.c
View file

@ -449,8 +449,8 @@ static void cds_set_5g_channel_params(uint16_t oper_ch,
{
enum channel_state chan_state = CHANNEL_STATE_ENABLE;
enum channel_state chan_state2 = CHANNEL_STATE_ENABLE;
const struct bonded_chan *bonded_chan_ptr;
const struct bonded_chan *bonded_chan_ptr2;
const struct bonded_chan *bonded_chan_ptr = NULL;
const struct bonded_chan *bonded_chan_ptr2 = NULL;
if (CH_WIDTH_MAX <= ch_params->ch_width)
ch_params->ch_width = CH_WIDTH_80P80MHZ;
@ -481,16 +481,19 @@ static void cds_set_5g_channel_params(uint16_t oper_ch,
bonded_chan_40mhz_array,
QDF_ARRAY_SIZE(bonded_chan_40mhz_array),
&bonded_chan_ptr2);
if (oper_ch == bonded_chan_ptr2->start_ch)
ch_params->sec_ch_offset =
if (bonded_chan_ptr && bonded_chan_ptr2) {
if (oper_ch ==
bonded_chan_ptr2->start_ch)
ch_params->sec_ch_offset =
PHY_DOUBLE_CHANNEL_LOW_PRIMARY;
else
ch_params->sec_ch_offset =
else
ch_params->sec_ch_offset =
PHY_DOUBLE_CHANNEL_HIGH_PRIMARY;
ch_params->center_freq_seg0 =
(bonded_chan_ptr->start_ch +
bonded_chan_ptr->end_ch)/2;
ch_params->center_freq_seg0 =
(bonded_chan_ptr->start_ch +
bonded_chan_ptr->end_ch)/2;
}
}
break;
}
@ -501,8 +504,10 @@ static void cds_set_5g_channel_params(uint16_t oper_ch,
chan_state = cds_search_5g_bonded_channel(oper_ch,
CH_WIDTH_80MHZ,
&bonded_chan_ptr);
ch_params->center_freq_seg0 = (bonded_chan_ptr->start_ch +
bonded_chan_ptr->end_ch)/2;
if (bonded_chan_ptr)
ch_params->center_freq_seg0 =
(bonded_chan_ptr->start_ch +
bonded_chan_ptr->end_ch)/2;
}
QDF_TRACE(QDF_MODULE_ID_QDF, QDF_TRACE_LEVEL_INFO,
"ch %d ch_wd %d freq0 %d freq1 %d", oper_ch,