From ea6b5e603c98527a12605fa60f159fee14d983bc Mon Sep 17 00:00:00 2001
From: gaurank kathpalia <gkathpal@codeaurora.org>
Date: Thu, 5 Jul 2018 20:41:28 +0530
Subject: [PATCH] qcacld-3.0: Fix KW issue in hdd_sme_roam_callback

The driver may dereference pRoamInfo by calling APIs
in hdd_sme_roam_callback which have arguements of
structure tagCsrRoamInfo.

Fix is to have a check for pRoamInfo, and then only
pass its struct members as arguments to other API.

Change-Id: I28acee0ff42a50221f6dbef7af4b9c04dd6e8d1e
CRs-Fixed: 2259290
---
 core/hdd/src/wlan_hdd_assoc.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/core/hdd/src/wlan_hdd_assoc.c b/core/hdd/src/wlan_hdd_assoc.c
index e97a07212413..04d0c6c1649e 100644
--- a/core/hdd/src/wlan_hdd_assoc.c
+++ b/core/hdd/src/wlan_hdd_assoc.c
@@ -4783,7 +4783,8 @@ hdd_sme_roam_callback(void *pContext, struct csr_roam_info *roam_info,
 #endif
 #ifdef WLAN_FEATURE_11W
 	case eCSR_ROAM_UNPROT_MGMT_FRAME_IND:
-		hdd_indicate_unprot_mgmt_frame(adapter,
+		if (roam_info)
+			hdd_indicate_unprot_mgmt_frame(adapter,
 					       roam_info->nFrameLength,
 					       roam_info->pbFrames,
 					       roam_info->frameType);
@@ -4791,7 +4792,8 @@ hdd_sme_roam_callback(void *pContext, struct csr_roam_info *roam_info,
 #endif
 #ifdef FEATURE_WLAN_ESE
 	case eCSR_ROAM_TSM_IE_IND:
-		hdd_indicate_tsm_ie(adapter, roam_info->tsmIe.tsid,
+		if (roam_info)
+			hdd_indicate_tsm_ie(adapter, roam_info->tsmIe.tsid,
 				    roam_info->tsmIe.state,
 				    roam_info->tsmIe.msmt_interval);
 		break;