From 680c3e8340f62361aafa648c416ce61beb348a39 Mon Sep 17 00:00:00 2001 From: Tushnim Bhattacharyya Date: Thu, 30 Aug 2018 11:38:37 -0700 Subject: [PATCH] qcacmn: Fix NULL pointer dereference in dfs In target_if_radar_event_handler, target_if_dfs_cac_complete_event_handler & target_if_dfs_radar_detection_event_handler wmi_handle is derived & dereferenced with out a NULL check. Add a NULL check for wmi_handle before it is dereferenced. Change-Id: I6dde5132a6a2e31a25654bd818a90e1c164a4a74 CRs-Fixed: 2305505 --- target_if/dfs/src/target_if_dfs.c | 10 +++++++- .../dfs/src/target_if_dfs_full_offload.c | 23 +++++++++++++++---- 2 files changed, 28 insertions(+), 5 deletions(-) diff --git a/target_if/dfs/src/target_if_dfs.c b/target_if/dfs/src/target_if_dfs.c index 13541614fcd6..41f7ee33dad7 100644 --- a/target_if/dfs/src/target_if_dfs.c +++ b/target_if/dfs/src/target_if_dfs.c @@ -119,6 +119,7 @@ static int target_if_radar_event_handler( struct wlan_objmgr_psoc *psoc; struct wlan_objmgr_pdev *pdev; struct wlan_lmac_if_dfs_rx_ops *dfs_rx_ops; + struct wmi_unified *wmi_handle; if (!scn || !data) { target_if_err("scn: %pK, data: %pK", scn, data); @@ -135,8 +136,15 @@ static int target_if_radar_event_handler( target_if_err("Invalid dfs_rx_ops: %pK", dfs_rx_ops); return -EINVAL; } + + wmi_handle = get_wmi_unified_hdl_from_psoc(psoc); + if (!wmi_handle) { + target_if_err("Invalid WMI context"); + return -EINVAL; + } + if (QDF_IS_STATUS_ERROR(wmi_extract_wlan_radar_event_info( - GET_WMI_HDL_FROM_PSOC(psoc), data, + wmi_handle, data, &wlan_radar_event, datalen))) { target_if_err("failed to extract wlan radar event"); return -EFAULT; diff --git a/target_if/dfs/src/target_if_dfs_full_offload.c b/target_if/dfs/src/target_if_dfs_full_offload.c index eba5c80dfdc3..654d59b4368c 100644 --- a/target_if/dfs/src/target_if_dfs_full_offload.c +++ b/target_if/dfs/src/target_if_dfs_full_offload.c @@ -46,6 +46,7 @@ static int target_if_dfs_cac_complete_event_handler( struct wlan_objmgr_pdev *pdev; int ret = 0; uint32_t vdev_id = 0; + struct wmi_unified *wmi_handle; if (!scn || !data) { target_if_err("scn: %pK, data: %pK", scn, data); @@ -64,8 +65,14 @@ static int target_if_dfs_cac_complete_event_handler( return -EINVAL; } - if (wmi_extract_dfs_cac_complete_event(GET_WMI_HDL_FROM_PSOC(psoc), - data, &vdev_id, datalen) != QDF_STATUS_SUCCESS) { + wmi_handle = get_wmi_unified_hdl_from_psoc(psoc); + if (!wmi_handle) { + target_if_err("Invalid WMI handle"); + return -EINVAL; + } + + if (wmi_extract_dfs_cac_complete_event(wmi_handle, data, &vdev_id, + datalen) != QDF_STATUS_SUCCESS) { target_if_err("failed to extract cac complete event"); return -EFAULT; } @@ -109,6 +116,7 @@ static int target_if_dfs_radar_detection_event_handler( struct wlan_objmgr_pdev *pdev = NULL; struct wlan_lmac_if_dfs_rx_ops *dfs_rx_ops; int ret = 0; + struct wmi_unified *wmi_handle; if (!scn || !data) { target_if_err("scn: %pK, data: %pK", scn, data); @@ -127,8 +135,15 @@ static int target_if_dfs_radar_detection_event_handler( return -EINVAL; } - if (wmi_extract_dfs_radar_detection_event(GET_WMI_HDL_FROM_PSOC(psoc), - data, &radar, datalen) != QDF_STATUS_SUCCESS) { + wmi_handle = get_wmi_unified_hdl_from_psoc(psoc); + if (!wmi_handle) { + target_if_err("Invalid WMI handle"); + return -EINVAL; + } + + if (wmi_extract_dfs_radar_detection_event(wmi_handle, data, &radar, + datalen) + != QDF_STATUS_SUCCESS) { target_if_err("failed to extract cac complete event"); return -EFAULT; }