From ebe01e7a16a452fb8fc29657eb37be2febe3eff6 Mon Sep 17 00:00:00 2001
From: Kabilan Kannan <kabilank@codeaurora.org>
Date: Wed, 13 Jun 2018 01:13:46 -0700
Subject: [PATCH] qcacld-3.0: Validate SAR2 response event handle

Validate SAR2 response event handle and pass the valid
pointer for result extraction

Change-Id: I91982c411c77494662f6d00de6078622a3d548ae
CRs-Fixed: 2259373
---
 core/wma/inc/wma_internal.h |  4 ++--
 core/wma/src/wma_features.c | 20 ++++++++++++++++++--
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/core/wma/inc/wma_internal.h b/core/wma/inc/wma_internal.h
index 5a2c0139c864..3233d582dba0 100644
--- a/core/wma/inc/wma_internal.h
+++ b/core/wma/inc/wma_internal.h
@@ -1068,13 +1068,13 @@ QDF_STATUS wma_set_led_flashing(tp_wma_handle wma_handle,
 
 /**
  * wma_sar_rsp_evt_handler() -  process sar response event from FW.
- * @handle: wma handle
+ * @handle: ol scn handle
  * @event: event buffer
  * @len: buffer length
  *
  * Return: 0 for success or error code
  */
-int wma_sar_rsp_evt_handler(void *handle, uint8_t *event, uint32_t len);
+int wma_sar_rsp_evt_handler(ol_scn_t handle, uint8_t *event, uint32_t len);
 
 #ifdef FEATURE_WLAN_CH_AVOID
 QDF_STATUS wma_process_ch_avoid_update_req(tp_wma_handle wma_handle,
diff --git a/core/wma/src/wma_features.c b/core/wma/src/wma_features.c
index 014bbbbfe3b2..b8612af323a9 100644
--- a/core/wma/src/wma_features.c
+++ b/core/wma/src/wma_features.c
@@ -4032,11 +4032,27 @@ QDF_STATUS wma_set_led_flashing(tp_wma_handle wma_handle,
 }
 #endif /* WLAN_FEATURE_GPIO_LED_FLASHING */
 
-int wma_sar_rsp_evt_handler(void *handle, uint8_t *event, uint32_t len)
+int wma_sar_rsp_evt_handler(ol_scn_t handle, uint8_t *event, uint32_t len)
 {
+	tp_wma_handle wma_handle;
+	wmi_unified_t wmi_handle;
 	QDF_STATUS status;
 
-	status = wmi_unified_extract_sar2_result_event(handle,
+	WMA_LOGD(FL("handle:%pK event:%pK len:%u"), handle, event, len);
+
+	wma_handle = handle;
+	if (!wma_handle) {
+		WMA_LOGE(FL("NULL wma_handle"));
+		return QDF_STATUS_E_INVAL;
+	}
+
+	wmi_handle = wma_handle->wmi_handle;
+	if (!wmi_handle) {
+		WMA_LOGE(FL("NULL wmi_handle"));
+		return QDF_STATUS_E_INVAL;
+	}
+
+	status = wmi_unified_extract_sar2_result_event(wmi_handle,
 						       event, len);
 	if (QDF_IS_STATUS_ERROR(status)) {
 		WMA_LOGE(FL("Event extract failure: %d"), status);