From 4d01f9bf6a6c2071a37f0a2c900466b3f336d06b Mon Sep 17 00:00:00 2001 From: Tushnim Bhattacharyya Date: Thu, 30 Aug 2018 13:26:21 -0700 Subject: [PATCH] qcacmn: Fix NULL pointer dereference in tdls In target_if_tdls_update_fw_state, target_if_tdls_set_offchan_mode, & target_if_tdls_set_uapsd wmi_handle is derived & dereferenced with out a NULL check. Add a NULL check for wmi_handle before it is dereferenced. Change-Id: If741f69773a712cebcd1be889ca09d01eee97fae CRs-Fixed: 2305520 --- src/target_if_tdls.c | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-) diff --git a/src/target_if_tdls.c b/src/target_if_tdls.c index bbb3c32cf096..f6b248e93d53 100644 --- a/src/target_if_tdls.c +++ b/src/target_if_tdls.c @@ -82,6 +82,13 @@ target_if_tdls_update_fw_state(struct wlan_objmgr_psoc *psoc, { QDF_STATUS status; uint8_t tdls_state; + struct wmi_unified *wmi_handle; + + wmi_handle = get_wmi_unified_hdl_from_psoc(psoc); + if (!wmi_handle) { + target_if_err("Invalid WMI handle"); + return QDF_STATUS_E_FAILURE; + } if (TDLS_SUPPORT_EXP_TRIG_ONLY == param->tdls_state) tdls_state = WMI_TDLS_ENABLE_PASSIVE; @@ -91,7 +98,7 @@ target_if_tdls_update_fw_state(struct wlan_objmgr_psoc *psoc, else tdls_state = WMI_TDLS_DISABLE; - status = wmi_unified_update_fw_tdls_state_cmd(GET_WMI_HDL_FROM_PSOC(psoc), + status = wmi_unified_update_fw_tdls_state_cmd(wmi_handle, param, tdls_state); target_if_debug("vdev_id %d", param->vdev_id); @@ -110,8 +117,14 @@ target_if_tdls_set_offchan_mode(struct wlan_objmgr_psoc *psoc, struct tdls_channel_switch_params *params) { QDF_STATUS status; + struct wmi_unified *wmi_handle; - status = wmi_unified_set_tdls_offchan_mode_cmd(GET_WMI_HDL_FROM_PSOC(psoc), + wmi_handle = get_wmi_unified_hdl_from_psoc(psoc); + if (!wmi_handle) { + target_if_err("Invalid WMI handle"); + return QDF_STATUS_E_FAILURE; + } + status = wmi_unified_set_tdls_offchan_mode_cmd(wmi_handle, params); return status; @@ -122,8 +135,13 @@ target_if_tdls_set_uapsd(struct wlan_objmgr_psoc *psoc, struct sta_uapsd_trig_params *params) { QDF_STATUS ret; - wmi_unified_t wmi_handle = get_wmi_unified_hdl_from_psoc(psoc); + struct wmi_unified *wmi_handle; + wmi_handle = get_wmi_unified_hdl_from_psoc(psoc); + if (!wmi_handle) { + target_if_err("Invalid WMI handle"); + return QDF_STATUS_E_FAILURE; + } if (!wmi_service_enabled(wmi_handle, wmi_sta_uapsd_basic_auto_trig) || !wmi_service_enabled(wmi_handle, @@ -132,7 +150,7 @@ target_if_tdls_set_uapsd(struct wlan_objmgr_psoc *psoc, params->vdevid); return QDF_STATUS_SUCCESS; } - ret = wmi_unified_set_sta_uapsd_auto_trig_cmd(GET_WMI_HDL_FROM_PSOC(psoc), + ret = wmi_unified_set_sta_uapsd_auto_trig_cmd(wmi_handle, params); if (QDF_IS_STATUS_ERROR(ret))