From cb9f73c8b4b945f7e3acd47baa278d388c0b65b2 Mon Sep 17 00:00:00 2001 From: Harprit Chhabada Date: Thu, 4 Apr 2019 14:24:43 -0700 Subject: [PATCH] qcacld-3.0: Fix possible NULL pointer issues in sme_set_plm_request() Pointer 'req' is dereference before null check which can lead to null pointer dereference. Pointer 'body' is never null check after allocation of memory. qdf_mem_malloc can return null and when pointer 'body' is dereference, it can lead to null pointer dereference. Change-Id: I62f26341079d4849c56f7d35d0b7c64df6b49f3b CRs-Fixed: 2424010 --- core/sme/src/common/sme_api.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/core/sme/src/common/sme_api.c b/core/sme/src/common/sme_api.c index 8ec8cdfe2f2f..fd9db782d143 100644 --- a/core/sme/src/common/sme_api.c +++ b/core/sme/src/common/sme_api.c @@ -1469,6 +1469,9 @@ QDF_STATUS sme_set_plm_request(mac_handle_t mac_handle, struct csr_roam_session *session; struct plm_req_params *body; + if (!req) + return QDF_STATUS_E_FAILURE; + status = sme_acquire_global_lock(&mac->sme); if (!QDF_IS_STATUS_SUCCESS(status)) return status; @@ -1489,8 +1492,12 @@ QDF_STATUS sme_set_plm_request(mac_handle_t mac_handle, /* per contract must make a copy of the params when messaging */ body = qdf_mem_malloc(sizeof(*body)); - if (!req) + + if (!body) { + sme_release_global_lock(&mac->sme); return QDF_STATUS_E_NOMEM; + } + *body = *req; if (!body->enable)