瀏覽代碼

qcacld-3.0: Fix uninitialized variable use in cds_set_5g_channel_params

Initialize pointers bonded_chan_ptr and bonded_chan_ptr2 in function
with NULL and add check to avoid NULL/wild pointer dereference.

Change-Id: I48e4417998d75a7a42d6e55106896709016ac61c
CRs-Fixed: 1075098
Arif Hussain 8 年之前
父節點
當前提交
4afc226c49
共有 1 個文件被更改,包括 16 次插入11 次删除
  1. 16 11
      core/cds/src/cds_reg_service.c

+ 16 - 11
core/cds/src/cds_reg_service.c

@@ -449,8 +449,8 @@ static void cds_set_5g_channel_params(uint16_t oper_ch,
 {
 	enum channel_state chan_state = CHANNEL_STATE_ENABLE;
 	enum channel_state chan_state2 = CHANNEL_STATE_ENABLE;
-	const struct bonded_chan *bonded_chan_ptr;
-	const struct bonded_chan *bonded_chan_ptr2;
+	const struct bonded_chan *bonded_chan_ptr = NULL;
+	const struct bonded_chan *bonded_chan_ptr2 = NULL;
 
 	if (CH_WIDTH_MAX <= ch_params->ch_width)
 		ch_params->ch_width = CH_WIDTH_80P80MHZ;
@@ -481,16 +481,19 @@ static void cds_set_5g_channel_params(uint16_t oper_ch,
 							bonded_chan_40mhz_array,
 					QDF_ARRAY_SIZE(bonded_chan_40mhz_array),
 							     &bonded_chan_ptr2);
-				if (oper_ch == bonded_chan_ptr2->start_ch)
-					ch_params->sec_ch_offset =
+				if (bonded_chan_ptr && bonded_chan_ptr2) {
+					if (oper_ch ==
+					    bonded_chan_ptr2->start_ch)
+						ch_params->sec_ch_offset =
 						PHY_DOUBLE_CHANNEL_LOW_PRIMARY;
-				else
-					ch_params->sec_ch_offset =
+					else
+						ch_params->sec_ch_offset =
 						PHY_DOUBLE_CHANNEL_HIGH_PRIMARY;
 
-				ch_params->center_freq_seg0 =
-					(bonded_chan_ptr->start_ch +
-					 bonded_chan_ptr->end_ch)/2;
+					ch_params->center_freq_seg0 =
+						(bonded_chan_ptr->start_ch +
+						 bonded_chan_ptr->end_ch)/2;
+				}
 			}
 			break;
 		}
@@ -501,8 +504,10 @@ static void cds_set_5g_channel_params(uint16_t oper_ch,
 		chan_state = cds_search_5g_bonded_channel(oper_ch,
 							  CH_WIDTH_80MHZ,
 							  &bonded_chan_ptr);
-		ch_params->center_freq_seg0 = (bonded_chan_ptr->start_ch +
-				bonded_chan_ptr->end_ch)/2;
+		if (bonded_chan_ptr)
+			ch_params->center_freq_seg0 =
+				(bonded_chan_ptr->start_ch +
+				 bonded_chan_ptr->end_ch)/2;
 	}
 	QDF_TRACE(QDF_MODULE_ID_QDF, QDF_TRACE_LEVEL_INFO,
 			"ch %d ch_wd %d freq0 %d freq1 %d", oper_ch,