From 7b95da6afa60cdcd51d1635d77c2e9c22c5eb0ab Mon Sep 17 00:00:00 2001
From: gaurank kathpalia <gkathpal@codeaurora.org>
Date: Wed, 19 Sep 2018 16:18:53 +0530
Subject: [PATCH] qcacmn: Possible NULL pointer dereference in target-if

Currently, the return value of get_wmi_unified_hdl_from_psoc() API
is passing directly as argument to some functions without checking
the return value for NULL which may cause NULL pointer dereference.

To address this issue, add NULL checks for return value of
get_wmi_unified_hdl_from_psoc() API where ever it is getting used.

Change-Id: I9e9bf1372a8728e1af1be65065c9ba12f95ee305
CRs-Fixed: 2317025
---
 target_if/scan/src/target_if_scan.c | 45 +++++++++++++++++++++++++----
 1 file changed, 39 insertions(+), 6 deletions(-)

diff --git a/target_if/scan/src/target_if_scan.c b/target_if/scan/src/target_if_scan.c
index 7c1407174f0f..2c90e18120dc 100644
--- a/target_if/scan/src/target_if_scan.c
+++ b/target_if/scan/src/target_if_scan.c
@@ -56,6 +56,11 @@ target_if_scan_event_handler(ol_scn_t scn, uint8_t *data, uint32_t datalen)
 	}
 	wmi_handle = get_wmi_unified_hdl_from_psoc(psoc);
 
+	if (!wmi_handle) {
+		target_if_err("wmi_handle is NULL");
+		return -EINVAL;
+	}
+
 	event_info = qdf_mem_malloc(sizeof(*event_info));
 
 	if (!event_info) {
@@ -192,9 +197,16 @@ target_if_scan_register_pno_event_handler(struct wlan_objmgr_psoc *psoc,
 	void *arg)
 {
 	QDF_STATUS status;
+	struct wmi_unified *wmi_handle;
+
+	wmi_handle = get_wmi_unified_hdl_from_psoc(psoc);
+	if (!wmi_handle) {
+		target_if_err("Invalid WMI handle");
+		return QDF_STATUS_E_FAILURE;
+	}
 
 	status = wmi_unified_register_event(
-			get_wmi_unified_hdl_from_psoc(psoc),
+			wmi_handle,
 			wmi_nlo_match_event_id,
 			target_if_nlo_match_event_handler);
 	if (status) {
@@ -203,7 +215,7 @@ target_if_scan_register_pno_event_handler(struct wlan_objmgr_psoc *psoc,
 	}
 
 	status = wmi_unified_register_event(
-			get_wmi_unified_hdl_from_psoc(psoc),
+			wmi_handle,
 			wmi_nlo_scan_complete_event_id,
 			target_if_nlo_complete_handler);
 	if (status) {
@@ -219,9 +231,16 @@ target_if_scan_unregister_pno_event_handler(struct wlan_objmgr_psoc *psoc,
 		void *arg)
 {
 	QDF_STATUS status;
+	struct wmi_unified *wmi_handle;
+
+	wmi_handle = get_wmi_unified_hdl_from_psoc(psoc);
+	if (!wmi_handle) {
+		target_if_err("Invalid WMI handle");
+		return QDF_STATUS_E_FAILURE;
+	}
 
 	status = wmi_unified_unregister_event(
-			get_wmi_unified_hdl_from_psoc(psoc),
+			wmi_handle,
 			wmi_nlo_match_event_id);
 	if (status) {
 		target_if_err("Failed to unregister nlo match event cb");
@@ -229,7 +248,7 @@ target_if_scan_unregister_pno_event_handler(struct wlan_objmgr_psoc *psoc,
 	}
 
 	status = wmi_unified_unregister_event(
-			get_wmi_unified_hdl_from_psoc(psoc),
+			wmi_handle,
 			wmi_nlo_scan_complete_event_id);
 	if (status) {
 		target_if_err("Failed to unregister nlo scan comp event cb");
@@ -313,9 +332,16 @@ QDF_STATUS
 target_if_scan_register_event_handler(struct wlan_objmgr_psoc *psoc, void *arg)
 {
 	QDF_STATUS status;
+	struct wmi_unified *wmi_handle;
+
+	wmi_handle = get_wmi_unified_hdl_from_psoc(psoc);
+	if (!wmi_handle) {
+		target_if_err("Invalid WMI handle");
+		return QDF_STATUS_E_FAILURE;
+	}
 
 	status = wmi_unified_register_event(
-			get_wmi_unified_hdl_from_psoc(psoc),
+			wmi_handle,
 			wmi_scan_event_id,
 			target_if_scan_event_handler);
 	if (status) {
@@ -333,9 +359,16 @@ target_if_scan_unregister_event_handler(struct wlan_objmgr_psoc *psoc,
 		void *arg)
 {
 	QDF_STATUS status;
+	struct wmi_unified *wmi_handle;
+
+	wmi_handle = get_wmi_unified_hdl_from_psoc(psoc);
+	if (!wmi_handle) {
+		target_if_err("Invalid WMI handle");
+		return QDF_STATUS_E_FAILURE;
+	}
 
 	status = wmi_unified_unregister_event(
-			get_wmi_unified_hdl_from_psoc(psoc),
+			wmi_handle,
 			wmi_scan_event_id);
 	if (status) {
 		target_if_err("Failed to unregister Scan match event cb");