A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 08:36:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Possible NULL pointer dereference in target-if

Browse source 
Currently, the return value of get_wmi_unified_hdl_from_psoc() API
is passing directly as argument to some functions without checking
the return value for NULL which may cause NULL pointer dereference.

To address this issue, add NULL checks for return value of
get_wmi_unified_hdl_from_psoc() API where ever it is getting used.

Change-Id: I9e9bf1372a8728e1af1be65065c9ba12f95ee305
CRs-Fixed: 2317025
This commit is contained in:
gaurank kathpalia 2018-09-19 16:18:53 +05:30 • committed by nshrivas
commit 7b95da6afa
1 changed files with 39 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

45
target_if/scan/src/target_if_scan.c
View file

@ -56,6 +56,11 @@ target_if_scan_event_handler(ol_scn_t scn, uint8_t *data, uint32_t datalen)
}
wmi_handle = get_wmi_unified_hdl_from_psoc(psoc);
if (!wmi_handle) {
target_if_err("wmi_handle is NULL");
return -EINVAL;
}
event_info = qdf_mem_malloc(sizeof(*event_info));
if (!event_info) {
@ -192,9 +197,16 @@ target_if_scan_register_pno_event_handler(struct wlan_objmgr_psoc *psoc,
void *arg)
{
QDF_STATUS status;
struct wmi_unified *wmi_handle;
wmi_handle = get_wmi_unified_hdl_from_psoc(psoc);
if (!wmi_handle) {
target_if_err("Invalid WMI handle");
return QDF_STATUS_E_FAILURE;
}
status = wmi_unified_register_event(
get_wmi_unified_hdl_from_psoc(psoc),
wmi_handle,
wmi_nlo_match_event_id,
target_if_nlo_match_event_handler);
if (status) {
@ -203,7 +215,7 @@ target_if_scan_register_pno_event_handler(struct wlan_objmgr_psoc *psoc,
}
status = wmi_unified_register_event(
get_wmi_unified_hdl_from_psoc(psoc),
wmi_handle,
wmi_nlo_scan_complete_event_id,
target_if_nlo_complete_handler);
if (status) {
@ -219,9 +231,16 @@ target_if_scan_unregister_pno_event_handler(struct wlan_objmgr_psoc *psoc,
void *arg)
{
QDF_STATUS status;
struct wmi_unified *wmi_handle;
wmi_handle = get_wmi_unified_hdl_from_psoc(psoc);
if (!wmi_handle) {
target_if_err("Invalid WMI handle");
return QDF_STATUS_E_FAILURE;
}
status = wmi_unified_unregister_event(
get_wmi_unified_hdl_from_psoc(psoc),
wmi_handle,
wmi_nlo_match_event_id);
if (status) {
target_if_err("Failed to unregister nlo match event cb");
@ -229,7 +248,7 @@ target_if_scan_unregister_pno_event_handler(struct wlan_objmgr_psoc *psoc,
}
status = wmi_unified_unregister_event(
get_wmi_unified_hdl_from_psoc(psoc),
wmi_handle,
wmi_nlo_scan_complete_event_id);
if (status) {
target_if_err("Failed to unregister nlo scan comp event cb");
@ -313,9 +332,16 @@ QDF_STATUS
target_if_scan_register_event_handler(struct wlan_objmgr_psoc *psoc, void *arg)
{
QDF_STATUS status;
struct wmi_unified *wmi_handle;
wmi_handle = get_wmi_unified_hdl_from_psoc(psoc);
if (!wmi_handle) {
target_if_err("Invalid WMI handle");
return QDF_STATUS_E_FAILURE;
}
status = wmi_unified_register_event(
get_wmi_unified_hdl_from_psoc(psoc),
wmi_handle,
wmi_scan_event_id,
target_if_scan_event_handler);
if (status) {
@ -333,9 +359,16 @@ target_if_scan_unregister_event_handler(struct wlan_objmgr_psoc *psoc,
void *arg)
{
QDF_STATUS status;
struct wmi_unified *wmi_handle;
wmi_handle = get_wmi_unified_hdl_from_psoc(psoc);
if (!wmi_handle) {
target_if_err("Invalid WMI handle");
return QDF_STATUS_E_FAILURE;
}
status = wmi_unified_unregister_event(
get_wmi_unified_hdl_from_psoc(psoc),
wmi_handle,
wmi_scan_event_id);
if (status) {
target_if_err("Failed to unregister Scan match event cb");