From dc7f2c9c2fa37f500b951cb561632e8d9e90ebb9 Mon Sep 17 00:00:00 2001 From: Archana Ramachandran Date: Mon, 27 Jun 2016 11:44:13 -0700 Subject: [PATCH] qcacld-3.0: Fix NULL pointer dereferencing in p2p TX MGMT Fix dereferencing channel struct pointer without verifying the validity. CRs-Fixed: 1034743 Change-Id: I7a49467c3fdbe85c7255fcce7f135e53658eef63 --- core/hdd/src/wlan_hdd_p2p.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/core/hdd/src/wlan_hdd_p2p.c b/core/hdd/src/wlan_hdd_p2p.c index e7bd3315b86a..9d41dc3e8c68 100644 --- a/core/hdd/src/wlan_hdd_p2p.c +++ b/core/hdd/src/wlan_hdd_p2p.c @@ -1411,7 +1411,9 @@ int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, home_ch = goAdapter->sessionCtx.ap.operatingChannel; } - if (ieee80211_frequency_to_channel(chan->center_freq) == home_ch) { + if (chan && + (ieee80211_frequency_to_channel(chan->center_freq) == + home_ch)) { /* if adapter is already on requested ch, no need for ROC */ wait = 0; hddLog(LOG1, @@ -1419,7 +1421,7 @@ int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, goto send_frame; } - if (offchan && wait) { + if (offchan && wait && chan) { int status; rem_on_channel_request_type_t req_type = OFF_CHANNEL_ACTION_TX; /* In case of P2P Client mode if we are already */