From 5090805f150967065bd8246267caace4865effd7 Mon Sep 17 00:00:00 2001 From: Hanumantha Reddy Pothula Date: Wed, 29 Jul 2015 13:51:12 +0530 Subject: [PATCH] qcacld-3.0: Return NULL if zero is passed as argument to allocate memory qcacld-2.0 to qcacld-3.0 propagation While allocating memory if zero is passed as argument then kernel will return address ZERO_SIZE_PTR(0x10) leading to pass NULL check, which is usually done after every memory allocation. Hence when zero is passed to allocate memory then return NULL without calling kmalloc. While initializing neighbor roam data structure, don't allocate memory if neighbor roam channel list is empty. Change-Id: I50bdb99a0cd8ccbc2d764b8ac21f66bba8a8fdc4 CRs-Fixed: 815664 --- core/cdf/src/cdf_memory.c | 8 ++++---- core/sme/src/csr/csr_neighbor_roam.c | 20 +++++++++++++------- 2 files changed, 17 insertions(+), 11 deletions(-) diff --git a/core/cdf/src/cdf_memory.c b/core/cdf/src/cdf_memory.c index 732d1e59c9ff..2aba419f6477 100644 --- a/core/cdf/src/cdf_memory.c +++ b/core/cdf/src/cdf_memory.c @@ -195,9 +195,9 @@ void *cdf_mem_malloc_debug(size_t size, char *fileName, uint32_t lineNum) uint32_t new_size; int flags = GFP_KERNEL; - if (size > (1024 * 1024)) { + if (size > (1024 * 1024) || size == 0) { CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR, - "%s: called with arg > 1024K; passed in %zu !!!", + "%s: called with invalid arg; passed in %zu !!!", __func__, size); return NULL; } @@ -327,9 +327,9 @@ void *cdf_mem_malloc(size_t size) #ifdef CONFIG_WCNSS_MEM_PRE_ALLOC void *pmem; #endif - if (size > (1024 * 1024)) { + if (size > (1024 * 1024) || size == 0) { CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR, - "%s: called with arg > 1024K; passed in %zu !!", + "%s: called with invalid arg; passed in %zu !!", __func__, size); return NULL; } diff --git a/core/sme/src/csr/csr_neighbor_roam.c b/core/sme/src/csr/csr_neighbor_roam.c index 13a9bc8b89e1..31cae0c215ba 100644 --- a/core/sme/src/csr/csr_neighbor_roam.c +++ b/core/sme/src/csr/csr_neighbor_roam.c @@ -2763,15 +2763,21 @@ CDF_STATUS csr_neighbor_roam_init(tpAniSirGlobal pMac, uint8_t sessionId) pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels = pMac->roam.configParam.neighborRoamConfig.neighborScanChanList. numChannels; - - pNeighborRoamInfo->cfgParams.channelInfo.ChannelList = + if (pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels != 0) { + pNeighborRoamInfo->cfgParams.channelInfo.ChannelList = cdf_mem_malloc(pMac->roam.configParam.neighborRoamConfig. - neighborScanChanList.numChannels); - - if (NULL == pNeighborRoamInfo->cfgParams.channelInfo.ChannelList) { - sms_log(pMac, LOGE, + neighborScanChanList.numChannels); + if (NULL == + pNeighborRoamInfo->cfgParams.channelInfo.ChannelList) { + sms_log(pMac, LOGE, FL("Memory Allocation for CFG Channel List failed")); - return CDF_STATUS_E_NOMEM; + return CDF_STATUS_E_NOMEM; + } + } else { + pNeighborRoamInfo->cfgParams.channelInfo.ChannelList = NULL; + sms_log(pMac, LOGE, + FL("invalid neighbor roam channel list: %u"), + pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels); } /* Update the roam global structure from CFG */