From 6cbf9764e602c83ee9f35b4a6fda40ed7f4d61d4 Mon Sep 17 00:00:00 2001 From: Frank Liu Date: Fri, 16 Nov 2018 11:41:20 +0800 Subject: [PATCH] qcacmn: Fix KW issue in tdls Potential NULL pointer dereferences in below functions: tdls_delete_all_tdls_peers_flush_cb() ucfg_tdls_notify_sta_connect() Change-Id: Iee31d91b31c5921fbd5cc70e0b893093b496ee43 CRs-Fixed: 2350930 --- umac/tdls/core/src/wlan_tdls_ct.c | 6 +++--- umac/tdls/dispatcher/src/wlan_tdls_ucfg_api.c | 3 ++- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/umac/tdls/core/src/wlan_tdls_ct.c b/umac/tdls/core/src/wlan_tdls_ct.c index 7be612d4b0ce..d2fa6bb71acf 100644 --- a/umac/tdls/core/src/wlan_tdls_ct.c +++ b/umac/tdls/core/src/wlan_tdls_ct.c @@ -1123,10 +1123,10 @@ int tdls_set_tdls_offchannelmode(struct wlan_objmgr_vdev *vdev, static QDF_STATUS tdls_delete_all_tdls_peers_flush_cb(struct scheduler_msg *msg) { - if (msg && msg->bodyptr) + if (msg && msg->bodyptr) { qdf_mem_free(msg->bodyptr); - - msg->bodyptr = NULL; + msg->bodyptr = NULL; + } return QDF_STATUS_SUCCESS; } diff --git a/umac/tdls/dispatcher/src/wlan_tdls_ucfg_api.c b/umac/tdls/dispatcher/src/wlan_tdls_ucfg_api.c index e1936cfc6252..cd86729d8a02 100644 --- a/umac/tdls/dispatcher/src/wlan_tdls_ucfg_api.c +++ b/umac/tdls/dispatcher/src/wlan_tdls_ucfg_api.c @@ -825,7 +825,8 @@ QDF_STATUS ucfg_tdls_notify_sta_connect( notify = qdf_mem_malloc(sizeof(*notify)); if (!notify) { - wlan_objmgr_vdev_release_ref(notify->vdev, WLAN_TDLS_NB_ID); + wlan_objmgr_vdev_release_ref(notify_info->vdev, + WLAN_TDLS_NB_ID); return QDF_STATUS_E_NULL_VALUE; }