From 8e94f725edb61b459767ff489bc943c6d964febc Mon Sep 17 00:00:00 2001
From: Varun Reddy Yeturu <varunreddy.yeturu@codeaurora.org>
Date: Thu, 17 May 2018 14:57:18 -0700
Subject: [PATCH] qcacld-3.0: Fix mac address check in
 lim_send_sme_mgmt_frame_ind

Broadcast mac address check is performed on an empty buffer pointer
before it is filled. Use the input frame pointer instead.

CRs-Fixed: 2191063
Change-Id: Ie02dcf05da70d52a0f3532b8d5647a7e8e0bcfe8
---
 core/mac/src/pe/lim/lim_utils.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/mac/src/pe/lim/lim_utils.c b/core/mac/src/pe/lim/lim_utils.c
index 252286597602..5e8bb9989d9a 100644
--- a/core/mac/src/pe/lim/lim_utils.c
+++ b/core/mac/src/pe/lim/lim_utils.c
@@ -8294,7 +8294,7 @@ void lim_send_sme_mgmt_frame_ind(tpAniSirGlobal mac_ctx, uint8_t frame_type,
 	}
 
 	if (qdf_is_macaddr_broadcast(
-		(struct qdf_mac_addr *) sme_mgmt_frame->frameBuf + 4) &&
+		(struct qdf_mac_addr *)(frame + 4)) &&
 		!session_id) {
 		pe_debug("Broadcast action frame");
 		session_id = SME_SESSION_ID_BROADCAST;