From b3606a896a6615e07dedc9bcababb7fe091eb5f7 Mon Sep 17 00:00:00 2001 From: Qun Zhang Date: Wed, 26 Dec 2018 17:08:07 +0800 Subject: [PATCH] qcacmn: Add sanity check for wifi_pos priv obj in wifi_pos_main.c Add sanity check before pointer dereferenced in wifi_pos_main.c Change-Id: Iaea0c56f0684e2cfc959153b09468811a16ef22e CRs-Fixed: 2370311 --- umac/wifi_pos/src/wifi_pos_main.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/umac/wifi_pos/src/wifi_pos_main.c b/umac/wifi_pos/src/wifi_pos_main.c index 7bc766afface..73d2f4e0052d 100644 --- a/umac/wifi_pos/src/wifi_pos_main.c +++ b/umac/wifi_pos/src/wifi_pos_main.c @@ -166,6 +166,11 @@ static QDF_STATUS wifi_pos_process_set_cap_req(struct wlan_objmgr_psoc *psoc, struct wifi_pos_user_defined_caps *caps = (struct wifi_pos_user_defined_caps *)req->buf; + if (!wifi_pos_obj) { + wifi_pos_err("wifi_pos priv obj is null"); + return QDF_STATUS_E_INVAL; + } + wifi_pos_debug("Received set cap req pid(%d), len(%d)", req->pid, req->buf_len); @@ -187,6 +192,11 @@ static QDF_STATUS wifi_pos_process_get_cap_req(struct wlan_objmgr_psoc *psoc, struct wifi_pos_psoc_priv_obj *wifi_pos_obj = wifi_pos_get_psoc_priv_obj(psoc); + if (!wifi_pos_obj) { + wifi_pos_err("wifi_pos priv obj is null"); + return QDF_STATUS_E_INVAL; + } + wifi_pos_debug("Received get cap req pid(%d), len(%d)", req->pid, req->buf_len); @@ -284,6 +294,11 @@ static QDF_STATUS wifi_pos_process_ch_info_req(struct wlan_objmgr_psoc *psoc, struct wifi_pos_psoc_priv_obj *wifi_pos_obj = wifi_pos_get_psoc_priv_obj(psoc); + if (!wifi_pos_obj) { + wifi_pos_err("wifi_pos priv obj is null"); + return QDF_STATUS_E_INVAL; + } + wifi_pos_debug("Received ch info req pid(%d), len(%d)", req->pid, req->buf_len); @@ -368,6 +383,11 @@ static QDF_STATUS wifi_pos_process_app_reg_req(struct wlan_objmgr_psoc *psoc, struct wifi_pos_psoc_priv_obj *wifi_pos_obj = wifi_pos_get_psoc_priv_obj(psoc); + if (!wifi_pos_obj) { + wifi_pos_err("wifi_pos priv obj is null"); + return QDF_STATUS_E_INVAL; + } + wifi_pos_err("Received App Req Req pid(%d), len(%d)", req->pid, req->buf_len);