From f904765f82ac8a8a716147f31b3adeaa8828815c Mon Sep 17 00:00:00 2001
From: bings <bings@codeaurora.org>
Date: Thu, 31 Aug 2017 08:05:54 +0800
Subject: [PATCH] qcacld-3.0: Fix chain_stats memory illegal access

chain_stats in WMI_UPDATE_STATS_EVENTID_param_tlvs may be set as
NULL by wlan firmware.

When access chain_stats, make sure it is not NULL.

Change-Id: I3a78534899a3a56f378c4825ff5b8abedb543b8c
CRs-Fixed: 2102247
---
 core/wma/src/wma_utils.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c
index fb62c723d057..dd6321d893e6 100644
--- a/core/wma/src/wma_utils.c
+++ b/core/wma/src/wma_utils.c
@@ -2942,14 +2942,16 @@ int wma_stats_event_handler(void *handle, uint8_t *cmd_param_info,
 
 		rssi_event =
 			(wmi_per_chain_rssi_stats *) param_buf->chain_stats;
-		if (rssi_event && (rssi_event->num_per_chain_rssi_stats >
-		    ((WMI_SVC_MSG_MAX_SIZE - sizeof(*event)) /
-		    sizeof(*peer_stats)))) {
-			excess_data = true;
-			break;
-		} else {
-			buf_len += rssi_event->num_per_chain_rssi_stats *
-						sizeof(*peer_stats);
+		if (rssi_event) {
+			if (rssi_event->num_per_chain_rssi_stats >
+			    ((WMI_SVC_MSG_MAX_SIZE - sizeof(*event)) /
+			    sizeof(*rssi_event))) {
+				excess_data = true;
+				break;
+			} else {
+				buf_len += sizeof(*rssi_event) *
+					rssi_event->num_per_chain_rssi_stats;
+			}
 		}
 	} while (0);