瀏覽代碼

qcacld-3.0: Fix NULL memcpy in STA keepalive handler

Change I20cf9f54a7ec920a90575ffd73c51708414d46a0 ("qcacld-3.0: Use the
redesigned STA keepalive interface") updated the manner in which STA
keepalive parameters are passed to WMI. Unfortunately that change
introduced three instances of qdf_mem_copy() where the source pointer
may be NULL, so update that logic to test for NULL before performing
the copy. In each case the destination buffer will remain zeroed if
the source pointer is NULL.

Change-Id: I24aaad82bb73dba37297ac17b21f758da16617b4
CRs-Fixed: 2407449
Jeff Johnson 6 年之前
父節點
當前提交
4c2837fe92
共有 1 個文件被更改,包括 7 次插入4 次删除
  1. 7 4
      core/wma/src/wma_mgmt.c

+ 7 - 4
core/wma/src/wma_mgmt.c

@@ -864,7 +864,7 @@ void wma_set_sta_keep_alive(tp_wma_handle wma, uint8_t vdev_id,
 			    uint8_t *hostv4addr, uint8_t *destv4addr,
 			    uint8_t *destmac)
 {
-	struct sta_keep_alive_params params;
+	struct sta_keep_alive_params params = { 0 };
 
 	WMA_LOGD("%s: Enter", __func__);
 
@@ -882,9 +882,12 @@ void wma_set_sta_keep_alive(tp_wma_handle wma, uint8_t vdev_id,
 	params.vdev_id = vdev_id;
 	params.method = method;
 	params.timeperiod = timeperiod;
-	qdf_mem_copy(params.hostv4addr, hostv4addr, QDF_IPV4_ADDR_SIZE);
-	qdf_mem_copy(params.destv4addr, destv4addr, QDF_IPV4_ADDR_SIZE);
-	qdf_mem_copy(params.destmac, destmac, QDF_MAC_ADDR_SIZE);
+	if (hostv4addr)
+		qdf_mem_copy(params.hostv4addr, hostv4addr, QDF_IPV4_ADDR_SIZE);
+	if (destv4addr)
+		qdf_mem_copy(params.destv4addr, destv4addr, QDF_IPV4_ADDR_SIZE);
+	if (destmac)
+		qdf_mem_copy(params.destmac, destmac, QDF_MAC_ADDR_SIZE);
 
 	wmi_unified_set_sta_keep_alive_cmd(wma->wmi_handle, &params);
 	WMA_LOGD("%s: Exit", __func__);