From c218b38a16efe4435c141b746a0781e3ee6992b9 Mon Sep 17 00:00:00 2001 From: Bala Venkatesh Date: Mon, 3 Jun 2019 17:50:55 +0530 Subject: [PATCH] qcacld-3.0: Avoid NULL pointer access in wlan_cfg80211_tdls_add_peer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In function wlan_cfg80211_tdls_add_peer, osif_tdls is allocated only for STA and P2P CLI vdevs. So if tdls connection is in progress on p2p_client vdev and at the same time if the driver gets the change iface for p2p client to p2p device, p2p device vdev is created with the same mac address replacing the p2p client vdev. Now if supplicant issues add_station command after change_iface on p2p interface, it tries to access osif_tdls pointer which is not allocated for p2p device vdev. This can lead to NULL pointer access of osif_tdls. Add check for NULL pointer before accessing osif_tdls pointer for adding station command. Change-Id: I2cd63d4d758af360987e1563022918548d113d76 CRs-Fixed: 2464766 --- os_if/tdls/src/wlan_cfg80211_tdls.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/os_if/tdls/src/wlan_cfg80211_tdls.c b/os_if/tdls/src/wlan_cfg80211_tdls.c index e071c8f8391b..53c11e7d02e9 100644 --- a/os_if/tdls/src/wlan_cfg80211_tdls.c +++ b/os_if/tdls/src/wlan_cfg80211_tdls.c @@ -231,6 +231,11 @@ int wlan_cfg80211_tdls_add_peer(struct wlan_objmgr_vdev *vdev, } osif_priv = wlan_vdev_get_ospriv(vdev); + if (!osif_priv || !osif_priv->osif_tdls) { + cfg80211_err("osif_tdls_vdev or osif_priv is NULL for the current vdev"); + status = -EINVAL; + goto error; + } tdls_priv = osif_priv->osif_tdls; add_peer_req->vdev_id = wlan_vdev_get_id(vdev);