From e48f34df004462a70ea18ababdbbdb5d40c5585e Mon Sep 17 00:00:00 2001 From: Abhinav Kumar Date: Fri, 12 Oct 2018 14:44:44 +0530 Subject: [PATCH] qcacld-3.0: Possible NULL Pointer Dereference in wma_send_bcn_buf_ll While handling the WMI_HOST_SWBA_EVENTID WMI FW event, driver invokes corresponding wma handler wma_beacon_swba_handler. The event argument comes directly from the FW. Towards the end of the function, wma_beacon_swba_handler invokes wma_send_bcn_buf_ll and passes the original TLV structure, param_buf, as an argument. wma_send_bcn_buf_ll pull tim_info and p2p_noa_info from the param_buf structure. These structures can be optionally defined in the message with zero length resulting in them being NULL pointers. Later, throughout the function they are then deferenced without every checking if they are in fact NULL. Fix is to make sure in wma_send_bcn_buf_ll, param_buf->tim_info and param_buf->p2p_noa_info dereferenced only after NULL check. Change-Id: Ic27b59dd35f74413e9a978627047855e655b9ed1 CRs-Fixed: 2331956 --- core/wma/src/wma_mgmt.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c index 96bd2015e225..c1221d6b5751 100644 --- a/core/wma/src/wma_mgmt.c +++ b/core/wma/src/wma_mgmt.c @@ -107,6 +107,12 @@ static void wma_send_bcn_buf_ll(tp_wma_handle wma, WMA_LOGE("%s: Invalid beacon buffer", __func__); return; } + + if (!param_buf->tim_info || !param_buf->p2p_noa_info) { + WMA_LOGE("%s: Invalid tim info or p2p noa info", __func__); + return; + } + if (WMI_UNIFIED_NOA_ATTR_NUM_DESC_GET(p2p_noa_info) > WMI_P2P_MAX_NOA_DESCRIPTORS) { WMA_LOGE("%s: Too many descriptors %d", __func__,