From d3f63c4fe84f17add62fd7af2d5de4ec29f2c7e0 Mon Sep 17 00:00:00 2001 From: Lincoln Tran Date: Wed, 16 Sep 2020 17:39:00 -0700 Subject: [PATCH] qcacld-3.0: Fix potential NULL ptr dereference in if_mgr The peer objmgr pointer in the if_mgr_roam module may be NULL if there is no peer connected. Add check to see if pointer is NULL before dereferencing it. Also modify logic to only check if the vdev is in STA or P2P_CLI mode. Change-Id: I7370ca5b9c74bd81f6e958cf740b6ee426f4faad CRs-fixed: 2779831 --- .../interface_mgr/src/wlan_if_mgr_roam.c | 21 ++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/components/cmn_services/interface_mgr/src/wlan_if_mgr_roam.c b/components/cmn_services/interface_mgr/src/wlan_if_mgr_roam.c index 6cc4fed609c5..9d0041f9f74e 100644 --- a/components/cmn_services/interface_mgr/src/wlan_if_mgr_roam.c +++ b/components/cmn_services/interface_mgr/src/wlan_if_mgr_roam.c @@ -192,12 +192,27 @@ static void if_mgr_get_vdev_id_from_bssid(struct wlan_objmgr_pdev *pdev, { struct bssid_search_arg *bssid_arg = arg; struct wlan_objmgr_vdev *vdev = (struct wlan_objmgr_vdev *)object; - struct wlan_objmgr_vdev_objmgr *objmgr = &vdev->vdev_objmgr; - struct wlan_objmgr_peer *peer = objmgr->bss_peer; + struct wlan_objmgr_peer *peer; + + if (!(wlan_vdev_mlme_get_opmode(vdev) == QDF_STA_MODE || + wlan_vdev_mlme_get_opmode(vdev) == QDF_P2P_CLIENT_MODE)) + return; + + /* Need to check the connection manager state when that becomes + * available + */ + if (wlan_vdev_mlme_get_state(vdev) != WLAN_VDEV_S_UP) + return; + + peer = wlan_objmgr_vdev_try_get_bsspeer(vdev, WLAN_IF_MGR_ID); + if (!peer) + return; if (WLAN_ADDR_EQ(bssid_arg->peer_addr.bytes, - wlan_peer_get_macaddr(peer))) + wlan_peer_get_macaddr(peer)) == QDF_STATUS_SUCCESS) bssid_arg->vdev_id = wlan_vdev_get_id(vdev); + + wlan_objmgr_peer_release_ref(peer, WLAN_IF_MGR_ID); } QDF_STATUS if_mgr_validate_candidate(struct wlan_objmgr_vdev *vdev,