瀏覽代碼

qcacmn: Fix static analysis invalid pointer dereference

Fix possibility of invalid pointer dereference pointed by
static analysis tool.

Change-Id: I9b682c44b2a1150015795a6cd497463eb7e3efd5
CRs-Fixed: 2407728
Om Prakash Tripathi 6 年之前
父節點
當前提交
510a27c966

+ 11 - 6
umac/scan/core/src/wlan_scan_main.h

@@ -619,17 +619,22 @@ static inline struct pdev_scan_ev_handler*
 wlan_pdev_get_pdev_scan_ev_handlers(struct wlan_objmgr_pdev *pdev)
 {
 	uint8_t pdevid;
-	struct wlan_scan_obj *scan;
-	struct pdev_scan_ev_handler *pdev_ev_handler;
+	struct wlan_scan_obj *scan = NULL;
 
-	pdevid = wlan_objmgr_pdev_get_pdev_id(pdev);
+	if (!pdev)
+		goto err;
 
+	pdevid = wlan_objmgr_pdev_get_pdev_id(pdev);
 	scan = wlan_pdev_get_scan_obj(pdev);
+	if (!scan)
+		goto err;
 
-	pdev_ev_handler =
-		&scan->global_evhandlers.pdev_ev_handlers[pdevid];
+	return &scan->global_evhandlers.pdev_ev_handlers[pdevid];
 
-	return pdev_ev_handler;
+err:
+	scm_err("NULL pointer, pdev: 0x%pK, scan_obj: 0x%pK",
+		pdev, scan);
+	return NULL;
 }
 
 /**

+ 7 - 0
umac/scan/dispatcher/src/wlan_scan_ucfg_api.c

@@ -903,6 +903,10 @@ ucfg_scan_register_event_handler(struct wlan_objmgr_pdev *pdev,
 
 	scan = wlan_pdev_get_scan_obj(pdev);
 	pdev_ev_handler = wlan_pdev_get_pdev_scan_ev_handlers(pdev);
+	if (!pdev_ev_handler) {
+		scm_err("null pdev_ev_handler");
+		return QDF_STATUS_E_NULL_VALUE;
+	}
 	cb_handler = &(pdev_ev_handler->cb_handlers[0]);
 
 	qdf_spin_lock_bh(&scan->lock);
@@ -1081,6 +1085,9 @@ ucfg_scan_unregister_event_handler(struct wlan_objmgr_pdev *pdev,
 		return;
 
 	pdev_ev_handler = wlan_pdev_get_pdev_scan_ev_handlers(pdev);
+	if (!pdev_ev_handler)
+		return;
+
 	cb_handler = &(pdev_ev_handler->cb_handlers[0]);
 
 	qdf_spin_lock_bh(&scan->lock);

+ 8 - 1
umac/scan/dispatcher/src/wlan_scan_utils_api.c

@@ -101,7 +101,10 @@ util_get_last_scan_time(struct wlan_objmgr_vdev *vdev)
 	pdev_id = wlan_scan_vdev_get_pdev_id(vdev);
 	scan_obj = wlan_vdev_get_scan_obj(vdev);
 
-	return scan_obj->pdev_info[pdev_id].last_scan_time;
+	if (scan_obj)
+		return scan_obj->pdev_info[pdev_id].last_scan_time;
+	else
+		return 0;
 }
 
 enum wlan_band util_scan_scm_chan_to_band(uint32_t chan)
@@ -860,6 +863,10 @@ util_scan_add_hidden_ssid(struct wlan_objmgr_pdev *pdev, qdf_nbuf_t bcnbuf)
 	}
 	pdev_id = wlan_objmgr_pdev_get_pdev_id(pdev);
 	scan_obj = wlan_pdev_get_scan_obj(pdev);
+	if (!scan_obj) {
+		scm_warn("null scan_obj");
+		return QDF_STATUS_E_NULL_VALUE;
+	}
 
 	conf_ssid = &scan_obj->pdev_info[pdev_id].conf_ssid;