From ab6ed4f112b0bf4ea024403f2178859967f6d95d Mon Sep 17 00:00:00 2001
From: Min Liu <minliu@codeaurora.org>
Date: Tue, 9 Jan 2018 13:13:57 +0800
Subject: [PATCH] qcacld-3.0: Fix NULL pointer and related issues

Fix for the following issues:

NULL pointer dereference
  - hdd_update_acs_channel
  - __wlan_hdd_cfg80211_update_vendor_channel

Uninitialized return value
  - hdd_is_fils_connection
  - wlan_hdd_cfg80211_wifi_set_reorder_timeout
  - wlan_hdd_cfg80211_wifi_set_rx_blocksize
  - __wlan_hdd_cfg80211_connect

Change-Id: I765d2324617262610236531bf7fe2f4043387df4
CRs-Fixed: 2168936
---
 core/hdd/src/wlan_hdd_assoc.c    |  2 ++
 core/hdd/src/wlan_hdd_cfg80211.c | 23 +++++++++++++++--------
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/core/hdd/src/wlan_hdd_assoc.c b/core/hdd/src/wlan_hdd_assoc.c
index ae69b2f81d65..bf8232761d36 100644
--- a/core/hdd/src/wlan_hdd_assoc.c
+++ b/core/hdd/src/wlan_hdd_assoc.c
@@ -4969,6 +4969,8 @@ static inline bool hdd_is_fils_connection(struct hdd_adapter *adapter)
 	if (wext_state->roamProfile.fils_con_info)
 		return wext_state->roamProfile.
 			fils_con_info->is_fils_connection;
+
+	return false;
 }
 #else
 static inline bool hdd_is_fils_connection(struct hdd_adapter *adapter)
diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c
index 46bc62e3a5f0..e61a50b14a32 100644
--- a/core/hdd/src/wlan_hdd_cfg80211.c
+++ b/core/hdd/src/wlan_hdd_cfg80211.c
@@ -6442,7 +6442,7 @@ static int wlan_hdd_handle_restrict_offchan_config(struct hdd_adapter *adapter,
 static int wlan_hdd_cfg80211_wifi_set_reorder_timeout(struct hdd_context *hdd_ctx,
 						      struct nlattr *tb[])
 {
-	int ret_val;
+	int ret_val = 0;
 	QDF_STATUS qdf_status;
 	struct sir_set_rx_reorder_timeout_val reorder_timeout;
 
@@ -6509,7 +6509,7 @@ static int wlan_hdd_cfg80211_wifi_set_rx_blocksize(struct hdd_context *hdd_ctx,
 						   struct hdd_adapter *adapter,
 						   struct nlattr *tb[])
 {
-	int ret_val;
+	int ret_val = 0;
 	uint32_t set_value;
 	QDF_STATUS qdf_status;
 	struct sir_peer_set_rx_blocksize rx_blocksize;
@@ -11150,6 +11150,11 @@ static int hdd_update_acs_channel(struct hdd_adapter *adapter, uint8_t reason,
 	struct hdd_context *hdd_ctx = WLAN_HDD_GET_CTX(adapter);
 	QDF_STATUS status = QDF_STATUS_SUCCESS;
 
+	if (!channel_list) {
+		hdd_err("channel_list is NULL");
+		return -EINVAL;
+	}
+
 	hdd_ap_ctx = WLAN_HDD_GET_AP_CTX_PTR(adapter);
 	sap_config = &adapter->session.ap.sap_config;
 
@@ -11159,7 +11164,7 @@ static int hdd_update_acs_channel(struct hdd_adapter *adapter, uint8_t reason,
 		qdf_mc_timer_stop(&adapter->session.ap.vendor_acs_timer);
 	}
 
-	if (channel_list && channel_list->pri_ch == 0) {
+	if (channel_list->pri_ch == 0) {
 		/* Check mode, set default channel */
 		channel_list->pri_ch = 6;
 		/*
@@ -11200,7 +11205,7 @@ static int hdd_update_acs_channel(struct hdd_adapter *adapter, uint8_t reason,
 		hdd_info("invalid reason for timer invoke");
 	}
 	EXIT();
-	return status;
+	return qdf_status_to_os_return(status);
 }
 
 /**
@@ -11386,7 +11391,7 @@ static int __wlan_hdd_cfg80211_update_vendor_channel(struct wiphy *wiphy,
 		channel_cnt--;
 		channel_list++;
 	}
-	hdd_debug("received primary channel as %d", channel_list->pri_ch);
+
 	if ((channel_cnt <= 0) || !channel_list) {
 		hdd_err("no available channel/chanlist %d/%pK", channel_cnt,
 			channel_list);
@@ -11394,10 +11399,12 @@ static int __wlan_hdd_cfg80211_update_vendor_channel(struct wiphy *wiphy,
 		return -EINVAL;
 	}
 
-	qdf_status = hdd_update_acs_channel(adapter, reason,
+	hdd_debug("received primary channel as %d", channel_list->pri_ch);
+
+	ret_val = hdd_update_acs_channel(adapter, reason,
 				      channel_cnt, channel_list);
 	qdf_mem_free(channel_list_ptr);
-	return qdf_status_to_os_return(qdf_status);
+	return ret_val;
 }
 
 /**
@@ -18221,7 +18228,7 @@ static int __wlan_hdd_cfg80211_connect(struct wiphy *wiphy,
 
 	/* Check for max concurrent connections after doing disconnect if any */
 	if (req->channel) {
-		bool ok;
+		bool ok = false;
 
 		if (req->channel->hw_value && policy_mgr_is_chan_ok_for_dnbs(
 						hdd_ctx->hdd_psoc,