Преглед на файлове

qcacld-3.0: Fix NULL pointer dereference

When sending an MSCS action frame to from SME to PE module, there is a
potential NULL pointer dereference. Add check to ensure BSS descriptor
is valid before copying it into the message.

Change-Id: If6d114cb923e5bd283a342ba2b136ce75c9a26b4
CRs-fixed: 2830747
Lincoln Tran преди 4 години
родител
ревизия
4e841495eb
променени са 1 файла, в които са добавени 5 реда и са изтрити 0 реда
  1. 5 0
      core/sme/src/qos/sme_qos.c

+ 5 - 0
core/sme/src/qos/sme_qos.c

@@ -3839,6 +3839,11 @@ void sme_send_mscs_action_frame(uint8_t vdev_id)
 		return;
 
 	mscs_req->vdev_id = vdev_id;
+	if (!qos_session->assocInfo.bss_desc) {
+		sme_err("BSS descriptor is NULL so we won't send request to PE");
+		qdf_mem_free(mscs_req);
+		return;
+	}
 	qdf_mem_copy(&mscs_req->bssid.bytes[0],
 		     &qos_session->assocInfo.bss_desc->bssId[0],
 		     sizeof(struct qdf_mac_addr));