浏览代码

qcacld-3.0: Fix potential pointer dereferenced for hdd_ctx & mac_handle

Add sanity checking to fix the potential pointer dereferenced after call
the __cds_get_context or hdd_adapter_get_mac_handle.

Change-Id: I53bdfa8434bdbbd6b70b0d98469e05c2e05ead28
CRs-Fixed: 3426731
Tiger Yu 2 年之前
父节点
当前提交
321259b2fa
共有 1 个文件被更改,包括 14 次插入4 次删除
  1. 14 4
      core/hdd/src/wlan_hdd_cfg80211.c

+ 14 - 4
core/hdd/src/wlan_hdd_cfg80211.c

@@ -9686,15 +9686,15 @@ hdd_latency_level_event_handler_cb(const struct latency_level_data *event_data,
 
 	hdd_enter();
 
+	if (wlan_hdd_validate_context(hdd_ctx))
+		return;
+
 	hdd_adapter = hdd_get_adapter_by_vdev(hdd_ctx, vdev_id);
 	if (!hdd_adapter) {
 		hdd_err("adapter is NULL vdev_id = %d", vdev_id);
 		return;
 	}
 
-	if (wlan_hdd_validate_context(hdd_ctx))
-		return;
-
 	if (!event_data) {
 		hdd_err("Invalid latency level event data");
 		return;
@@ -20061,7 +20061,7 @@ int wlan_hdd_cfg80211_register_frames(struct hdd_adapter *adapter)
 	mac_handle_t mac_handle = hdd_adapter_get_mac_handle(adapter);
 	/* Register for all P2P action, public action etc frames */
 	uint16_t type = (SIR_MAC_MGMT_FRAME << 2) | (SIR_MAC_MGMT_ACTION << 4);
-	QDF_STATUS status;
+	QDF_STATUS status = QDF_STATUS_E_INVAL;
 
 	hdd_enter();
 	if (adapter->device_mode == QDF_FTM_MODE) {
@@ -20069,6 +20069,11 @@ int wlan_hdd_cfg80211_register_frames(struct hdd_adapter *adapter)
 		return 0;
 	}
 
+	if (!mac_handle) {
+		hdd_err("mac_handle is NULL, failed to register frames");
+		goto ret_status;
+	}
+
 	/* Register frame indication call back */
 	status = sme_register_mgmt_frame_ind_callback(mac_handle,
 						      hdd_indicate_mgmt_frame);
@@ -20170,6 +20175,11 @@ void wlan_hdd_cfg80211_deregister_frames(struct hdd_adapter *adapter)
 
 	hdd_enter();
 
+	if (!mac_handle) {
+		hdd_err("mac_handle is NULL, failed to deregister frames");
+		return;
+	}
+
 	/* Right now we are registering these frame when driver is getting
 	 * initialized. Once we will move to 2.6.37 kernel, in which we have
 	 * frame register ops, we will move this code as a part of that