From 4e30c9aba011bfe07a6cd053bb3363eb1aa1ab9e Mon Sep 17 00:00:00 2001 From: Shaakir Mohamed Date: Fri, 6 Apr 2018 14:37:03 -0700 Subject: [PATCH] qcacmn: Avoid null pointer dereference Check to prevent null pointer dereference. Change-Id: Iec0f7d7738aa99994e2cf7b0dae2e6cd4a34c709 CRs-Fixed: 2220175 --- dp/wifi3.0/dp_rx_mon_dest.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/dp/wifi3.0/dp_rx_mon_dest.c b/dp/wifi3.0/dp_rx_mon_dest.c index bfb57eb50cfc..a3408e52a397 100644 --- a/dp/wifi3.0/dp_rx_mon_dest.c +++ b/dp/wifi3.0/dp_rx_mon_dest.c @@ -302,10 +302,12 @@ dp_rx_mon_mpdu_pop(struct dp_soc *soc, uint32_t mac_id, msdu_list.msdu_info[i].msdu_len, qdf_nbuf_data(msdu), qdf_nbuf_len(msdu)); - if (*head_msdu == NULL) + if (head_msdu && *head_msdu == NULL) { *head_msdu = msdu; - else - qdf_nbuf_set_next(last, msdu); + } else { + if (last) + qdf_nbuf_set_next(last, msdu); + } last = msdu; dp_rx_add_to_free_desc_list(head, @@ -324,7 +326,8 @@ dp_rx_mon_mpdu_pop(struct dp_soc *soc, uint32_t mac_id, } while (buf_info.paddr && msdu_cnt); - qdf_nbuf_set_next(last, NULL); + if (last) + qdf_nbuf_set_next(last, NULL); *tail_msdu = msdu; @@ -360,10 +363,13 @@ qdf_nbuf_t dp_rx_mon_restitch_mpdu_from_msdus(struct dp_soc *soc, struct ieee80211_qoscntl *qos; struct dp_pdev *dp_pdev = dp_get_pdev_for_mac_id(soc, mac_id); head_frag_list = NULL; + mpdu_buf = NULL; /* The nbuf has been pulled just beyond the status and points to the * payload */ + if (!head_msdu) + goto mpdu_stitch_fail; msdu_orig = head_msdu; @@ -406,9 +412,6 @@ qdf_nbuf_t dp_rx_mon_restitch_mpdu_from_msdus(struct dp_soc *soc, mpdu_buf = head_msdu; - if (!mpdu_buf) - goto mpdu_stitch_fail; - prev_buf = mpdu_buf; frag_list_sum_len = 0;