ソースを参照

qcacld-3.0: Fix null pointer dereference in sme_handle_bcn_recv_start

In sme_handle_bcn_recv_start, 'mac_ctx->roam.roamSession' is not
validated for null before being passed to CSR_IS_SESSION_VALID where
dereference can occur.

Validate mac_ctx->roam.roamSession against null before passing it to
CSR_IS_SESSION_VALID.

Change-Id: I48638a320f29a906a6e8a35c000191265313b734
CRs-Fixed: 2462682
Abhinav Kumar 5 年 前
コミット
668bd125c0
1 ファイル変更5 行追加5 行削除
  1. 5 5
      core/sme/src/common/sme_api.c

+ 5 - 5
core/sme/src/common/sme_api.c

@@ -12620,17 +12620,17 @@ QDF_STATUS sme_handle_bcn_recv_start(mac_handle_t mac_handle,
 	struct csr_roam_session *session;
 	QDF_STATUS status;
 
-	if (!CSR_IS_SESSION_VALID(mac_ctx, vdev_id)) {
-		sme_err("CSR session not valid: %d", vdev_id);
-		return QDF_STATUS_E_FAILURE;
-	}
-
 	session = CSR_GET_SESSION(mac_ctx, vdev_id);
 	if (!session) {
 		sme_err("vdev_id %d not found", vdev_id);
 		return QDF_STATUS_E_FAILURE;
 	}
 
+	if (!CSR_IS_SESSION_VALID(mac_ctx, vdev_id)) {
+		sme_err("CSR session not valid: %d", vdev_id);
+		return QDF_STATUS_E_FAILURE;
+	}
+
 	status = sme_acquire_global_lock(&mac_ctx->sme);
 	if (QDF_IS_STATUS_SUCCESS(status)) {
 		if (session->is_bcn_recv_start) {