A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 22:40:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Add null pointer validation in wma_ll_stats_evt_handler()

Browse source 
Add validation code in wma_ll_stats_evt_handler().

Change-Id: I7d0331ce18b16650540724917194defaf65aed10
CRs-Fixed: 2348596
This commit is contained in:
Arif Hussain 2018-12-06 16:49:03 -08:00 • committed by nshrivas
commit b6ec264531
1 changed files with 29 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

38
core/wma/src/wma_utils.c
View file

@ -1080,7 +1080,6 @@ static int wma_ll_stats_evt_handler(void *handle, u_int8_t *event,
tSirLLStatsResults *link_stats_results;
wmi_chan_cca_stats *wmi_cca_stats;
wmi_peer_signal_stats *wmi_peer_signal;
wmi_peer_ac_rx_stats *wmi_peer_rx;
struct sir_wifi_ll_ext_stats *ll_stats;
struct sir_wifi_ll_ext_peer_stats *peer_stats;
struct sir_wifi_chan_cca_stats *cca_stats;
@ -1108,7 +1107,6 @@ static int wma_ll_stats_evt_handler(void *handle, u_int8_t *event,
fixed_param = param_buf->fixed_param;
wmi_cca_stats = param_buf->chan_cca_stats;
wmi_peer_signal = param_buf->peer_signal_stats;
wmi_peer_rx = param_buf->peer_ac_rx_stats;
if (fixed_param->num_peer_signal_stats >
param_buf->num_peer_signal_stats ||
fixed_param->num_peer_ac_tx_stats >
@ -1155,10 +1153,14 @@ static int wma_ll_stats_evt_handler(void *handle, u_int8_t *event,
ll_stats->peer_num = peer_num;
result = (uint8_t *)ll_stats->stats;
if (!result) {
WMA_LOGE("%s: result is null", __func__);
return -EINVAL;
}
peer_stats = (struct sir_wifi_ll_ext_peer_stats *)result;
ll_stats->peer_stats = peer_stats;
for (i = 0; i < peer_num; i++) {
for (i = 0; i < peer_num && peer_stats; i++) {
peer_stats[i].peer_id = WIFI_INVALID_PEER_ID;
peer_stats[i].vdev_id = WIFI_INVALID_VDEV_ID;
}
@ -1166,7 +1168,10 @@ static int wma_ll_stats_evt_handler(void *handle, u_int8_t *event,
/* Per peer signal */
result_size -= sizeof(struct sir_wifi_ll_ext_stats);
dst_len = sizeof(struct sir_wifi_peer_signal_stats);
for (i = 0; i < fixed_param->num_peer_signal_stats; i++) {
for (i = 0;
i < fixed_param->num_peer_signal_stats &&
peer_stats && wmi_peer_signal;
i++) {
peer_stats[i].peer_id = wmi_peer_signal->peer_id;
peer_stats[i].vdev_id = wmi_peer_signal->vdev_id;
peer_signal = &peer_stats[i].peer_signal_stats;
@ -1174,7 +1179,7 @@ static int wma_ll_stats_evt_handler(void *handle, u_int8_t *event,
WMA_LOGD("%d antennas for peer %d",
wmi_peer_signal->num_chains_valid,
wmi_peer_signal->peer_id);
if (dst_len <= result_size) {
if (dst_len <= result_size && peer_signal) {
peer_signal->vdev_id = wmi_peer_signal->vdev_id;
peer_signal->peer_id = wmi_peer_signal->peer_id;
peer_signal->num_chain =
@ -1201,15 +1206,30 @@ static int wma_ll_stats_evt_handler(void *handle, u_int8_t *event,
result += peer_num * sizeof(struct sir_wifi_ll_ext_peer_stats);
cca_stats = (struct sir_wifi_chan_cca_stats *)result;
ll_stats->cca = cca_stats;
dst_len = sizeof(struct sir_wifi_chan_cca_stats);
for (i = 0; i < ll_stats->channel_num; i++) {
dst_len = sizeof(*cca_stats);
for (i = 0;
i < ll_stats->channel_num && cca_stats && wmi_cca_stats;
i++) {
if (dst_len <= result_size) {
qdf_mem_copy(&cca_stats[i], &wmi_cca_stats->vdev_id,
dst_len);
cca_stats->vdev_id = wmi_cca_stats->vdev_id;
cca_stats->idle_time = wmi_cca_stats->idle_time;
cca_stats->tx_time = wmi_cca_stats->tx_time;
cca_stats->rx_in_bss_time =
wmi_cca_stats->rx_in_bss_time;
cca_stats->rx_out_bss_time =
wmi_cca_stats->rx_out_bss_time;
cca_stats->rx_busy_time = wmi_cca_stats->rx_busy_time;
cca_stats->rx_in_bad_cond_time =
wmi_cca_stats->rx_in_bad_cond_time;
cca_stats->tx_in_bad_cond_time =
wmi_cca_stats->tx_in_bad_cond_time;
cca_stats->wlan_not_avail_time =
wmi_cca_stats->wlan_not_avail_time;
result_size -= dst_len;
} else {
WMA_LOGE(FL("Invalid length of CCA."));
}
cca_stats++;
}
result += i * sizeof(struct sir_wifi_chan_cca_stats);