From d525947221764566890451afd3402ec8f817eba1 Mon Sep 17 00:00:00 2001 From: Frank Liu Date: Wed, 19 Sep 2018 16:23:57 +0800 Subject: [PATCH] qcacmn: Fix KW issue in tdls Potential NULL pointer dereferences of wmi_handle are found in these functions: target_if_tdls_event_handler() target_if_tdls_register_event_handler() target_if_tdls_unregister_event_handler() Do wmi_handle NULL check in the above functions. Change-Id: I7cb4b574750d6bc6538862aa24a0cf49831b7c25 CRs-Fixed: 2317029 --- src/target_if_tdls.c | 31 ++++++++++++++++++++++++------- 1 file changed, 24 insertions(+), 7 deletions(-) diff --git a/src/target_if_tdls.c b/src/target_if_tdls.c index f6b248e93d53..6adb2622319e 100644 --- a/src/target_if_tdls.c +++ b/src/target_if_tdls.c @@ -59,6 +59,11 @@ target_if_tdls_event_handler(ol_scn_t scn, uint8_t *data, uint32_t datalen) } wmi_handle = get_wmi_unified_hdl_from_psoc(psoc); + if (!wmi_handle) { + target_if_err("null wmi_handle"); + return -EINVAL; + } + if (wmi_extract_vdev_tdls_ev_param(wmi_handle, data, &info)) { target_if_err("Failed to extract wmi tdls event"); return -EINVAL; @@ -163,19 +168,31 @@ QDF_STATUS target_if_tdls_register_event_handler(struct wlan_objmgr_psoc *psoc, void *arg) { - return wmi_unified_register_event( - get_wmi_unified_hdl_from_psoc(psoc), - wmi_tdls_peer_event_id, - target_if_tdls_event_handler); + struct wmi_unified *wmi_handle; + + wmi_handle = get_wmi_unified_hdl_from_psoc(psoc); + if (!wmi_handle) { + target_if_err("null wmi_handle"); + return QDF_STATUS_E_INVAL; + } + return wmi_unified_register_event(wmi_handle, + wmi_tdls_peer_event_id, + target_if_tdls_event_handler); } QDF_STATUS target_if_tdls_unregister_event_handler(struct wlan_objmgr_psoc *psoc, void *arg) { - return wmi_unified_unregister_event( - get_wmi_unified_hdl_from_psoc(psoc), - wmi_tdls_peer_event_id); + struct wmi_unified *wmi_handle; + + wmi_handle = get_wmi_unified_hdl_from_psoc(psoc); + if (!wmi_handle) { + target_if_err("null wmi_handle"); + return QDF_STATUS_E_INVAL; + } + return wmi_unified_unregister_event(wmi_handle, + wmi_tdls_peer_event_id); } QDF_STATUS