Эх сурвалжийг харах

qcacmn: Avoid NULL pointer dereferences

Add checks to avoid NULL pointer dereferences

Change-Id: I4b53936d6e08b5bb27c77dd9097a14c87d38f5a6
CRs-Fixed: 2887354
Himanshu Batra 4 жил өмнө
parent
commit
311a257c9e

+ 1 - 1
umac/mlme/connection_mgr/core/src/wlan_cm_connect.c

@@ -1440,7 +1440,7 @@ cm_resume_connect_after_peer_create(struct cnx_mgr *cm_ctx, wlan_cm_id *cm_id)
 	QDF_STATUS status;
 	struct security_info *neg_sec_info;
 	uint16_t rsn_caps;
-	uint8_t country_code[REG_ALPHA2_LEN + 1];
+	uint8_t country_code[REG_ALPHA2_LEN + 1] = {0};
 	struct wlan_objmgr_psoc *psoc;
 
 	psoc = wlan_pdev_get_psoc(wlan_vdev_get_pdev(cm_ctx->vdev));

+ 2 - 0
umac/mlme/connection_mgr/core/src/wlan_cm_roam_util.c

@@ -133,6 +133,8 @@ bool cm_get_active_reassoc_req(struct wlan_objmgr_vdev *vdev,
 	uint32_t cm_id_prefix;
 
 	cm_ctx = cm_get_cm_ctx(vdev);
+	if (!cm_ctx)
+		return status;
 
 	cm_req_lock_acquire(cm_ctx);
 	qdf_list_peek_front(&cm_ctx->req_list, &cur_node);

+ 3 - 5
umac/mlme/connection_mgr/core/src/wlan_cm_sm.c

@@ -44,11 +44,8 @@ void cm_sm_state_update(struct cnx_mgr *cm_ctx,
 			enum wlan_cm_sm_state state,
 			enum wlan_cm_sm_state substate)
 {
-	if (!cm_ctx) {
-		mlme_err("vdev %d cm_ctx is NULL",
-			 wlan_vdev_get_id(cm_ctx->vdev));
+	if (!cm_ctx)
 		return;
-	}
 
 	cm_set_state(cm_ctx, state);
 	cm_set_substate(cm_ctx, substate);
@@ -510,7 +507,8 @@ static bool cm_subst_join_pending_event(void *ctx, uint16_t event,
 						 resp->cm_id),
 				   cm_ctx->disconnect_count);
 			cm_req = cm_get_req_by_cm_id(cm_ctx, resp->cm_id);
-			cm_req->failed_req = true;
+			if (cm_req)
+				cm_req->failed_req = true;
 			cm_sm_transition_to(cm_ctx, WLAN_CM_S_DISCONNECTING);
 			break;
 		}

+ 7 - 0
umac/mlme/connection_mgr/core/src/wlan_cm_util.c

@@ -1088,6 +1088,9 @@ cm_get_active_req_type(struct wlan_objmgr_vdev *vdev)
 	uint32_t active_req_prefix = 0;
 
 	cm_ctx = cm_get_cm_ctx(vdev);
+	if (!cm_ctx)
+		return CM_NONE;
+
 	cm_id = cm_ctx->active_cm_id;
 
 	if (cm_id != CM_ID_INVALID)
@@ -1113,6 +1116,8 @@ bool cm_get_active_connect_req(struct wlan_objmgr_vdev *vdev,
 	uint32_t cm_id_prefix;
 
 	cm_ctx = cm_get_cm_ctx(vdev);
+	if (!cm_ctx)
+		return status;
 
 	cm_req_lock_acquire(cm_ctx);
 	qdf_list_peek_front(&cm_ctx->req_list, &cur_node);
@@ -1154,6 +1159,8 @@ bool cm_get_active_disconnect_req(struct wlan_objmgr_vdev *vdev,
 	uint32_t cm_id_prefix;
 
 	cm_ctx = cm_get_cm_ctx(vdev);
+	if (!cm_ctx)
+		return status;
 
 	cm_req_lock_acquire(cm_ctx);
 	qdf_list_peek_front(&cm_ctx->req_list, &cur_node);

+ 3 - 0
umac/mlme/connection_mgr/dispatcher/src/wlan_cm_api.c

@@ -307,6 +307,9 @@ void wlan_cm_req_history_print(struct wlan_objmgr_vdev *vdev)
 {
 	struct cnx_mgr *cm_ctx = cm_get_cm_ctx(vdev);
 
+	if (!cm_ctx)
+		return;
+
 	cm_req_history_print(cm_ctx);
 }
 #endif /* SM_ENG_HIST_ENABLE */