From 6f53cf10d5f55b0349f375b58f5ae67cd983b398 Mon Sep 17 00:00:00 2001 From: gaurank kathpalia Date: Tue, 26 Jun 2018 15:21:46 +0530 Subject: [PATCH] qcacld-3.0: Fix pointer dereference condition In the APi wlansap_roam_callback, under switch case of roam result eCSR_ROAM_RESULT_INFRA_ASSOCIATION_IND, the driver passes csr_roam_info in wlansap_roam_process_infra_assoc_ind without a NULL check for the same, which may cause pointer dereference. Fix is to call wlansap_roam_process_infra_assoc_ind only if csr_roam_info is valid Change-Id: I6388b7c8f7af827a5c2a862779f04b22c5c5f23e CRs-Fixed: 2260094 --- core/sap/src/sap_api_link_cntl.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/core/sap/src/sap_api_link_cntl.c b/core/sap/src/sap_api_link_cntl.c index dca75bb5d286..313bc66de628 100644 --- a/core/sap/src/sap_api_link_cntl.c +++ b/core/sap/src/sap_api_link_cntl.c @@ -1124,7 +1124,9 @@ wlansap_roam_callback(void *ctx, struct csr_roam_info *csr_roam_info, switch (roam_result) { case eCSR_ROAM_RESULT_INFRA_ASSOCIATION_IND: - wlansap_roam_process_infra_assoc_ind(sap_ctx, roam_result, + if (csr_roam_info) + wlansap_roam_process_infra_assoc_ind(sap_ctx, + roam_result, csr_roam_info, &qdf_ret_status); break; case eCSR_ROAM_RESULT_INFRA_ASSOCIATION_CNF: