Sfoglia il codice sorgente

qcacld-3.0: Fix NULL pointer dereference issues

"pe_find_session_by_vdev_id" API returns NULL in failure case.
Add NULL check before dereference "session" variable in below APIs
   - lim_send_epcs_action_req_frame.
   - lim_send_epcs_action_teardown_frame.
   - lim_send_t2lm_action_req_frame.

Change-Id: I5b8ce8c61b91f5a480b32a3a5883065faa247924
CRs-Fixed: 3528739
Sai Kumar Kunchala 1 anno fa
parent
commit
4dc6cafb4f
1 ha cambiato i file con 12 aggiunte e 0 eliminazioni
  1. 12 0
      core/mac/src/pe/lim/lim_send_management_frames.c

+ 12 - 0
core/mac/src/pe/lim/lim_send_management_frames.c

@@ -6499,6 +6499,10 @@ lim_send_epcs_action_req_frame(struct wlan_objmgr_vdev *vdev,
 	vdev_id = wlan_vdev_get_id(vdev);
 
 	session = pe_find_session_by_vdev_id(mac_ctx, vdev_id);
+	if (!session) {
+		pe_debug("session not found for given vdev_id %d ", vdev_id);
+		return QDF_STATUS_E_INVAL;
+	}
 
 	frm.Category.category = args->category;
 	frm.Action.action = args->action;
@@ -6608,6 +6612,10 @@ lim_send_epcs_action_teardown_frame(struct wlan_objmgr_vdev *vdev,
 	vdev_id = wlan_vdev_get_id(vdev);
 
 	session = pe_find_session_by_vdev_id(mac_ctx, vdev_id);
+	if (!session) {
+		pe_err("session not found for given vdev_id %d", vdev_id);
+		return QDF_STATUS_E_INVAL;
+	}
 
 	frm.Category.category = args->category;
 	frm.Action.action = args->action;
@@ -6825,6 +6833,10 @@ lim_send_t2lm_action_req_frame(struct wlan_objmgr_vdev *vdev,
 	vdev_id = wlan_vdev_get_id(vdev);
 
 	session = pe_find_session_by_vdev_id(mac_ctx, vdev_id);
+	if (!session) {
+		pe_err("session not found for given vdev_id %d", vdev_id);
+		return QDF_STATUS_E_INVAL;
+	}
 	session_id = session->smeSessionId;
 
 	qdf_mem_zero((uint8_t *)&frm, sizeof(frm));