From d897403241118fe2cecbf892fc2f1f482c599f70 Mon Sep 17 00:00:00 2001 From: sheenam monga Date: Wed, 12 Jun 2019 16:00:38 +0530 Subject: [PATCH] qcacmn: Fix null scan object dereference in ucfg Currently, ucfg_scan_register_pno_cb and ucfg_scan_get_scan_id do not do null validation for scan object which can lead to null pointer dereference. wlan_psoc_get_scan_obj_fl returns null in case of invalid component id or null psoc and that null scan object is dereferenced due to missing null validation. Add null pointer check for scan object in ucfg_scan_register_pno_cb and ucfg_scan_get_scan_id. Return zero scan id from ucfg_scan_get_scan_id in case of null scan object. Change-Id: I1aa1bdee001cace34e22ca11014455a0c7bcc462 CRs-Fixed: 2468518 --- umac/scan/dispatcher/src/wlan_scan_ucfg_api.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/umac/scan/dispatcher/src/wlan_scan_ucfg_api.c b/umac/scan/dispatcher/src/wlan_scan_ucfg_api.c index 8ae7bb61a4fb..28e8e53628ea 100644 --- a/umac/scan/dispatcher/src/wlan_scan_ucfg_api.c +++ b/umac/scan/dispatcher/src/wlan_scan_ucfg_api.c @@ -376,7 +376,13 @@ ucfg_scan_register_pno_cb(struct wlan_objmgr_psoc *psoc, scm_err("null psoc"); return QDF_STATUS_E_INVAL; } + scan = wlan_psoc_get_scan_obj(psoc); + if (!scan) { + scm_err("scan object null"); + return QDF_STATUS_E_INVAL; + } + qdf_spin_lock_bh(&scan->lock); scan->pno_cfg.pno_cb.func = event_cb; scan->pno_cfg.pno_cb.arg = arg; @@ -855,7 +861,12 @@ ucfg_scan_get_scan_id(struct wlan_objmgr_psoc *psoc) scm_err("null psoc"); return 0; } + scan = wlan_psoc_get_scan_obj(psoc); + if (!scan) { + scm_err("scan object null"); + return 0; + } id = qdf_atomic_inc_return(&scan->scan_ids); id = id & WLAN_SCAN_ID_MASK;