qcacld-3.0: Return NULL if zero is passed as argument to allocate memory

qcacld-2.0 to qcacld-3.0 propagation

While allocating memory if zero is passed as argument then kernel will
return address ZERO_SIZE_PTR(0x10) leading to pass NULL check, which is
usually done after every memory allocation. Hence when zero is passed to
allocate memory then return NULL without calling kmalloc.
While initializing neighbor roam data structure, don't allocate memory
if neighbor roam channel list is empty.

Change-Id: I50bdb99a0cd8ccbc2d764b8ac21f66bba8a8fdc4
CRs-Fixed: 815664

core/cdf/src/cdf_memory.c

@@ -195,9 +195,9 @@ void *cdf_mem_malloc_debug(size_t size, char *fileName, uint32_t lineNum)
 	uint32_t new_size;
 	int flags = GFP_KERNEL;
 
-	if (size > (1024 * 1024)) {
+	if (size > (1024 * 1024) || size == 0) {
 		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
-			  "%s: called with arg > 1024K; passed in %zu !!!",
+			  "%s: called with invalid arg; passed in %zu !!!",
 			  __func__, size);
 		return NULL;
 	}
@@ -327,9 +327,9 @@ void *cdf_mem_malloc(size_t size)
 #ifdef CONFIG_WCNSS_MEM_PRE_ALLOC
 	void *pmem;
 #endif
-	if (size > (1024 * 1024)) {
+	if (size > (1024 * 1024) || size == 0) {
 		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
-			  "%s: called with arg > 1024K; passed in %zu !!",
+			  "%s: called with invalid arg; passed in %zu !!",
 			  __func__, size);
 		return NULL;
 	}

core/sme/src/csr/csr_neighbor_roam.c

@@ -2763,15 +2763,21 @@ CDF_STATUS csr_neighbor_roam_init(tpAniSirGlobal pMac, uint8_t sessionId)
 	pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels =
 		pMac->roam.configParam.neighborRoamConfig.neighborScanChanList.
 		numChannels;
-
-	pNeighborRoamInfo->cfgParams.channelInfo.ChannelList =
+	if (pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels != 0) {
+		pNeighborRoamInfo->cfgParams.channelInfo.ChannelList =
 		cdf_mem_malloc(pMac->roam.configParam.neighborRoamConfig.
-			       neighborScanChanList.numChannels);
-
-	if (NULL == pNeighborRoamInfo->cfgParams.channelInfo.ChannelList) {
-		sms_log(pMac, LOGE,
+				neighborScanChanList.numChannels);
+		if (NULL ==
+			pNeighborRoamInfo->cfgParams.channelInfo.ChannelList) {
+			sms_log(pMac, LOGE,
 			FL("Memory Allocation for CFG Channel List failed"));
-		return CDF_STATUS_E_NOMEM;
+			return CDF_STATUS_E_NOMEM;
+		}
+	} else {
+		pNeighborRoamInfo->cfgParams.channelInfo.ChannelList = NULL;
+		sms_log(pMac, LOGE,
+			FL("invalid neighbor roam channel list: %u"),
+			pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels);
 	}
 
 	/* Update the roam global structure from CFG */