From b422f77258e38308d8a435823b972cdf0dc3bccd Mon Sep 17 00:00:00 2001 From: Wu Gao Date: Thu, 5 Jul 2018 11:34:36 +0800 Subject: [PATCH] qcacld-3.0: Check txrx vdev pointer before tx mgmt frame It get NULL pointer to txrx vdev when Rome platform tx mgmt frame in cdp_mgmt_send_ext, and then DUT broken since access NULL pointer. So, add protection before call cdp_mgmt_send_ext. Change-Id: Ia51a8183bf89115a4f0f3520b80186daa379602d CRs-Fixed: 2265687 --- core/wma/src/wma_mgmt.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c index c8c3e9889daa..90c0123f2a52 100644 --- a/core/wma/src/wma_mgmt.c +++ b/core/wma/src/wma_mgmt.c @@ -4297,7 +4297,8 @@ QDF_STATUS wma_mgmt_unified_cmd_send(struct wlan_objmgr_vdev *vdev, void *mgmt_tx_params) { tp_wma_handle wma_handle; - QDF_STATUS status; + int ret; + QDF_STATUS status = QDF_STATUS_E_INVAL; struct wmi_mgmt_params *mgmt_params = (struct wmi_mgmt_params *)mgmt_tx_params; void *soc = cds_get_context(QDF_MODULE_ID_SOC); @@ -4326,14 +4327,15 @@ QDF_STATUS wma_mgmt_unified_cmd_send(struct wlan_objmgr_vdev *vdev, wmi_service_mgmt_tx_wmi)) { status = wmi_mgmt_unified_cmd_send(wma_handle->wmi_handle, mgmt_params); - } else { + } else if (txrx_vdev) { QDF_NBUF_CB_MGMT_TXRX_DESC_ID(buf) = mgmt_params->desc_id; - status = cdp_mgmt_send_ext(soc, txrx_vdev, buf, - mgmt_params->tx_type, - mgmt_params->use_6mbps, - mgmt_params->chanfreq); + ret = cdp_mgmt_send_ext(soc, txrx_vdev, buf, + mgmt_params->tx_type, + mgmt_params->use_6mbps, + mgmt_params->chanfreq); + status = qdf_status_from_os_return(ret); } if (status != QDF_STATUS_SUCCESS) {