A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-11-09 12:24:07 -05:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix NULL pointer dereference in csr_roam_chk_lnk_swt_ch_ind

Browse source 
In the functioncsr_roam_chk_lnk_swt_ch_ind(), newChannelId is
updated to session->pConnectBssDesc->channelId and
pConnectBssDesc->ieFields is passed to wlan_cfg_get_ie_ptr().
the parameters of pConnectBssDesc are accessed without
validating pConnectBssDesc. This can result in possible null
pointer dereference.

Validate the session->pConnectBssDesc before access.

Change-Id: I45f2c090cea90052f91d678f1bacd1411c4b9496
CRs-Fixed: 2329317
This commit is contained in:
Pragaspathi Thilagaraj 2018-10-09 12:01:26 +05:30 • committed by nshrivas
commit f2bb62eeb7
1 changed files with 37 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

86
core/sme/src/csr/csr_api_roam.c
View file

@ -11697,6 +11697,7 @@ csr_roam_chk_lnk_swt_ch_ind(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
{
struct csr_roam_session *session;
uint32_t sessionId = CSR_SESSION_ID_INVALID;
uint16_t ie_len;
QDF_STATUS status;
tpSirSmeSwitchChannelInd pSwitchChnInd;
struct csr_roam_info roamInfo;
@ -11711,63 +11712,62 @@ csr_roam_chk_lnk_swt_ch_ind(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
*/
status = csr_roam_get_session_id_from_bssid(mac_ctx,
&pSwitchChnInd->bssid, &sessionId);
if (QDF_IS_STATUS_SUCCESS(status)) {
session = CSR_GET_SESSION(mac_ctx, sessionId);
if (!session) {
sme_err("session %d not found", sessionId);
return;
}
session->connectedProfile.operationChannel =
(uint8_t) pSwitchChnInd->newChannelId;
if (session->pConnectBssDesc) {
session->pConnectBssDesc->channelId =
(uint8_t) pSwitchChnInd->newChannelId;
}
if (QDF_IS_STATUS_ERROR(status))
return;
session = CSR_GET_SESSION(mac_ctx, sessionId);
if (!session) {
sme_err("session %d not found", sessionId);
return;
}
session->connectedProfile.operationChannel =
(uint8_t) pSwitchChnInd->newChannelId;
if (session->pConnectBssDesc) {
session->pConnectBssDesc->channelId =
(uint8_t) pSwitchChnInd->newChannelId;
ie_len = csr_get_ielen_from_bss_description(
session->pConnectBssDesc);
ds_params_ie = (tSirMacDsParamSetIE *)wlan_get_ie_ptr_from_eid(
DOT11F_EID_DSPARAMS,
(uint8_t *)session->pConnectBssDesc->
ieFields,
csr_get_ielen_from_bss_description(
session->pConnectBssDesc));
DOT11F_EID_DSPARAMS,
(uint8_t *)session->pConnectBssDesc->ieFields,
ie_len);
if (ds_params_ie)
ds_params_ie->channelNumber =
(uint8_t)pSwitchChnInd->newChannelId;
ht_info_ie = (tDot11fIEHTInfo *)wlan_get_ie_ptr_from_eid(
DOT11F_EID_HTINFO,
(uint8_t *)session->pConnectBssDesc->
ieFields,
csr_get_ielen_from_bss_description(
session->pConnectBssDesc));
DOT11F_EID_HTINFO,
(uint8_t *)session->pConnectBssDesc->ieFields,
ie_len);
if (ht_info_ie) {
ht_info_ie->primaryChannel =
(uint8_t)pSwitchChnInd->newChannelId;
ht_info_ie->secondaryChannelOffset =
pSwitchChnInd->chan_params.sec_ch_offset;
}
qdf_mem_set(&roamInfo, sizeof(struct csr_roam_info), 0);
roamInfo.chan_info.chan_id = pSwitchChnInd->newChannelId;
roamInfo.chan_info.ch_width =
pSwitchChnInd->chan_params.ch_width;
roamInfo.chan_info.sec_ch_offset =
pSwitchChnInd->chan_params.sec_ch_offset;
roamInfo.chan_info.band_center_freq1 =
pSwitchChnInd->chan_params.center_freq_seg0;
roamInfo.chan_info.band_center_freq2 =
pSwitchChnInd->chan_params.center_freq_seg1;
if (CSR_IS_PHY_MODE_11ac(mac_ctx->roam.configParam.phyMode))
roamInfo.mode = SIR_SME_PHY_MODE_VHT;
else if (CSR_IS_PHY_MODE_11n(mac_ctx->roam.configParam.phyMode))
roamInfo.mode = SIR_SME_PHY_MODE_HT;
else
roamInfo.mode = SIR_SME_PHY_MODE_LEGACY;
status = csr_roam_call_callback(mac_ctx, sessionId,
&roamInfo, 0, eCSR_ROAM_STA_CHANNEL_SWITCH,
eCSR_ROAM_RESULT_NONE);
}
qdf_mem_set(&roamInfo, sizeof(struct csr_roam_info), 0);
roamInfo.chan_info.chan_id = pSwitchChnInd->newChannelId;
roamInfo.chan_info.ch_width = pSwitchChnInd->chan_params.ch_width;
roamInfo.chan_info.sec_ch_offset =
pSwitchChnInd->chan_params.sec_ch_offset;
roamInfo.chan_info.band_center_freq1 =
pSwitchChnInd->chan_params.center_freq_seg0;
roamInfo.chan_info.band_center_freq2 =
pSwitchChnInd->chan_params.center_freq_seg1;
if (CSR_IS_PHY_MODE_11ac(mac_ctx->roam.configParam.phyMode))
roamInfo.mode = SIR_SME_PHY_MODE_VHT;
else if (CSR_IS_PHY_MODE_11n(mac_ctx->roam.configParam.phyMode))
roamInfo.mode = SIR_SME_PHY_MODE_HT;
else
roamInfo.mode = SIR_SME_PHY_MODE_LEGACY;
status = csr_roam_call_callback(mac_ctx, sessionId, &roamInfo, 0,
eCSR_ROAM_STA_CHANNEL_SWITCH,
eCSR_ROAM_RESULT_NONE);
}
static void