Explorar o código

qcacld-3.0: Fix NULL pointer dereference issue

"mlo_vdev_get_by_link_id" may return NULL in failure case.
Add NULL check and release the vdev after process in
function: epcs_handle_rx_req and epcs_handle_rx_resp.

Change-Id: Ia1575b4fbcfde326d8e9b5c7b0562852ca23912b
CRs-Fixed: 3547906
Paul Zhang hai 1 ano
pai
achega
4910df0bb1
Modificáronse 1 ficheiros con 10 adicións e 0 borrados
  1. 10 0
      components/umac/mlme/mlo_mgr/src/wlan_epcs_api.c

+ 10 - 0
components/umac/mlme/mlo_mgr/src/wlan_epcs_api.c

@@ -339,6 +339,9 @@ static QDF_STATUS epcs_handle_rx_req(struct wlan_objmgr_vdev *vdev,
 	for (i = 0; i < edca_info->num_links; i++) {
 		link = &edca_info->link_info[i];
 		link_vdev = mlo_get_vdev_by_link_id(vdev, link->link_id);
+		if (!link_vdev)
+			continue;
+
 		if (link->edca_ie_present)
 			epcs_update_edca_param(link_vdev, &link->edca);
 		else if (link->ven_wme_ie_present)
@@ -349,6 +352,8 @@ static QDF_STATUS epcs_handle_rx_req(struct wlan_objmgr_vdev *vdev,
 
 		if (link->muedca_ie_present)
 			epcs_update_mu_edca_param(link_vdev, &link->muedca);
+
+		mlo_release_vdev_ref(link_vdev);
 	}
 
 	args.category = ACTION_CATEGORY_PROTECTED_EHT;
@@ -417,6 +422,9 @@ static QDF_STATUS epcs_handle_rx_resp(struct wlan_objmgr_vdev *vdev,
 	for (i = 0; i < edca_info->num_links; i++) {
 		link = &edca_info->link_info[i];
 		link_vdev = mlo_get_vdev_by_link_id(vdev, link->link_id);
+		if (!link_vdev)
+			continue;
+
 		if (link->edca_ie_present)
 			epcs_update_edca_param(link_vdev, &link->edca);
 		else if (link->ven_wme_ie_present)
@@ -427,6 +435,8 @@ static QDF_STATUS epcs_handle_rx_resp(struct wlan_objmgr_vdev *vdev,
 
 		if (link->muedca_ie_present)
 			epcs_update_mu_edca_param(link_vdev, &link->muedca);
+
+		mlo_release_vdev_ref(link_vdev);
 	}
 
 	epcs_info->state = EPCS_ENABLE;