From ec59a16f7100e73ab230dd5af11905b8408cdd83 Mon Sep 17 00:00:00 2001 From: sheenam monga Date: Fri, 13 Dec 2019 13:18:10 +0530 Subject: [PATCH] qcacld-3.0: Fix null session dereference in lim_populate_he_mcs_set Currently, ch_width of session is checked without validating session which may lead to NULL pointer derefrence. validate session_entry before accessing element of pe_session Change-Id: I1f785555fa77a0c588e9b5245ad513fe059974d0 CRs-Fixed: 2585928 --- core/mac/src/pe/lim/lim_utils.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/core/mac/src/pe/lim/lim_utils.c b/core/mac/src/pe/lim/lim_utils.c index 493d7d304bf0..fc7aed9d91fa 100644 --- a/core/mac/src/pe/lim/lim_utils.c +++ b/core/mac/src/pe/lim/lim_utils.c @@ -7409,6 +7409,11 @@ QDF_STATUS lim_populate_he_mcs_set(struct mac_context *mac_ctx, return QDF_STATUS_SUCCESS; } + if (!session_entry) { + pe_err("session is NULL"); + return QDF_STATUS_E_FAILURE; + } + pe_debug("peer rates lt 80: rx_mcs - 0x%04x tx_mcs - 0x%04x", peer_he_caps->rx_he_mcs_map_lt_80, peer_he_caps->tx_he_mcs_map_lt_80); @@ -7419,7 +7424,7 @@ QDF_STATUS lim_populate_he_mcs_set(struct mac_context *mac_ctx, (*(uint16_t *)peer_he_caps->rx_he_mcs_map_80_80), (*(uint16_t *)peer_he_caps->tx_he_mcs_map_80_80)); - if (session_entry && session_entry->nss == NSS_2x2_MODE) { + if (session_entry->nss == NSS_2x2_MODE) { if (mac_ctx->lteCoexAntShare && wlan_reg_is_24ghz_ch_freq(session_entry->curr_op_freq)) { if (IS_2X2_CHAIN(session_entry->chainMask))