A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix possible NULL pointer issues in sme_set_plm_request()

Browse source 
Pointer 'req' is dereference before null check which can lead
to null pointer dereference.

Pointer 'body' is never null check after allocation of memory.
qdf_mem_malloc can return null and when pointer 'body' is
dereference, it can lead to null pointer dereference.

Change-Id: I62f26341079d4849c56f7d35d0b7c64df6b49f3b
CRs-Fixed: 2424010
This commit is contained in:
Harprit Chhabada 2019-04-04 14:24:43 -07:00 • committed by nshrivas
commit cb9f73c8b4
1 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
core/sme/src/common/sme_api.c
View file

@ -1469,6 +1469,9 @@ QDF_STATUS sme_set_plm_request(mac_handle_t mac_handle,
struct csr_roam_session *session;
struct plm_req_params *body;
if (!req)
return QDF_STATUS_E_FAILURE;
status = sme_acquire_global_lock(&mac->sme);
if (!QDF_IS_STATUS_SUCCESS(status))
return status;
@ -1489,8 +1492,12 @@ QDF_STATUS sme_set_plm_request(mac_handle_t mac_handle,
/* per contract must make a copy of the params when messaging */
body = qdf_mem_malloc(sizeof(*body));
if (!req)
if (!body) {
sme_release_global_lock(&mac->sme);
return QDF_STATUS_E_NOMEM;
}
*body = *req;
if (!body->enable)