Browse Source

qcacmn: Fix KW issue in tdls

Potential NULL pointer dereferences in below functions:
tdls_delete_all_tdls_peers_flush_cb()
ucfg_tdls_notify_sta_connect()

Change-Id: Iee31d91b31c5921fbd5cc70e0b893093b496ee43
CRs-Fixed: 2350930
Frank Liu 6 years ago
parent
commit
6cbf9764e6

+ 3 - 3
umac/tdls/core/src/wlan_tdls_ct.c

@@ -1123,10 +1123,10 @@ int tdls_set_tdls_offchannelmode(struct wlan_objmgr_vdev *vdev,
 
 static QDF_STATUS tdls_delete_all_tdls_peers_flush_cb(struct scheduler_msg *msg)
 {
-	if (msg && msg->bodyptr)
+	if (msg && msg->bodyptr) {
 		qdf_mem_free(msg->bodyptr);
-
-	msg->bodyptr = NULL;
+		msg->bodyptr = NULL;
+	}
 
 	return QDF_STATUS_SUCCESS;
 }

+ 2 - 1
umac/tdls/dispatcher/src/wlan_tdls_ucfg_api.c

@@ -825,7 +825,8 @@ QDF_STATUS ucfg_tdls_notify_sta_connect(
 
 	notify = qdf_mem_malloc(sizeof(*notify));
 	if (!notify) {
-		wlan_objmgr_vdev_release_ref(notify->vdev, WLAN_TDLS_NB_ID);
+		wlan_objmgr_vdev_release_ref(notify_info->vdev,
+					     WLAN_TDLS_NB_ID);
 		return QDF_STATUS_E_NULL_VALUE;
 	}