Browse Source

qcacld-3.0: Fix potential wma NULL pointer dereference

Potential NULL pointer dereference of wma pointer in
wma_pasn_peer_delete_all_complete() API.

Add validation of wma pointer before passing it to the
wma_resume_vdev_delete() API.

Change-Id: I9ccb7baa0dba4cb6bbb4a16fd90ee7e2aafde1c5
CRs-Fixed: 3340866
Pragaspathi Thilagaraj 2 years ago
parent
commit
3ee2631939
2 changed files with 9 additions and 1 deletions
  1. 4 1
      core/mac/src/pe/lim/lim_utils.c
  2. 5 0
      core/wma/src/wma_pasn_peer_api.c

+ 4 - 1
core/mac/src/pe/lim/lim_utils.c

@@ -582,13 +582,16 @@ lim_process_pasn_delete_all_peers(struct mac_context *mac,
 
 	if (!wma)
 		return QDF_STATUS_E_INVAL;
+
 	vdev = wlan_objmgr_get_vdev_by_id_from_psoc(mac->psoc, msg->vdev_id,
 						    WLAN_WIFI_POS_CORE_ID);
 	if (!vdev)
 		return QDF_STATUS_E_INVAL;
+
 	status = wma_delete_all_pasn_peers(wma, vdev);
 	if (QDF_IS_STATUS_ERROR(status))
-		pe_err("Failed to delete all PASN peers");
+		pe_err("Failed to delete all PASN peers for vdev:%d",
+		       msg->vdev_id);
 
 	wlan_objmgr_vdev_release_ref(vdev, WLAN_WIFI_POS_CORE_ID);
 

+ 5 - 0
core/wma/src/wma_pasn_peer_api.c

@@ -253,6 +253,11 @@ wma_pasn_peer_delete_all_complete(struct wlan_objmgr_vdev *vdev)
 	struct wma_target_req *req_msg;
 	uint8_t vdev_id = wlan_vdev_get_id(vdev);
 
+	if (!wma) {
+		wma_err("wma_handle is NULL");
+		return QDF_STATUS_E_FAILURE;
+	}
+
 	req_msg = wma_find_remove_req_msgtype(wma, vdev_id,
 					      WMA_PASN_PEER_DELETE_REQUEST);
 	if (!req_msg) {