qcacld-3.0: Avoid NULL pointer dereferenced

Pointer 'hdd_adapter_get_mac_handle(adapter)' returned from call to
function 'hdd_adapter_get_mac_handle' may be NULL and will be
dereferenced.

Check gen probe rsp len with buffer size to avoid OOB.

Change-Id: I58db7107504193b6f04c762594891cd6693e6aa3
CRs-Fixed: 3561351

core/hdd/src/wlan_hdd_cm_connect.c

@@ -199,9 +199,16 @@ void hdd_cm_update_rssi_snr_by_bssid(struct wlan_hdd_link_info *link_info)
 	struct hdd_station_ctx *sta_ctx;
 	int8_t snr = 0;
 	struct hdd_adapter *adapter = link_info->adapter;
+	mac_handle_t mac_handle;
+
+	mac_handle = hdd_adapter_get_mac_handle(adapter);
+	if (!mac_handle) {
+		hdd_err("mac_handle is NULL");
+		return;
+	}
 
 	sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(link_info);
-	hdd_get_rssi_snr_by_bssid(hdd_adapter_get_mac_handle(adapter),
+	hdd_get_rssi_snr_by_bssid(mac_handle,
 				  sta_ctx->conn_info.bssid.bytes,
 				  &link_info->rssi, &snr);
 

core/mac/src/pe/lim/lim_api.c

@@ -4297,14 +4297,14 @@ lim_gen_link_probe_rsp_roam(struct mac_context *mac_ctx,
 	}
 
 	if (!probe_rsp->mlo_ie.mlo_ie_present)
-		goto done;
+		goto err1;
 
 	/* Add received ml bcn/probe rsp to scan db */
 	src_addr = wlan_mlme_get_src_addr_from_frame(&frame);
 	if (!src_addr) {
 		pe_err("MLO: Failed to fetch src address");
 		status = QDF_STATUS_E_FAILURE;
-		goto done;
+		goto err1;
 	}
 	freq = mlo_roam_get_link_freq_from_mac_addr(roam_sync_ind,
 						    src_addr);
@@ -4320,7 +4320,7 @@ lim_gen_link_probe_rsp_roam(struct mac_context *mac_ctx,
 	if (!freq) {
 		pe_debug("MLO: Failed to fetch freq");
 		status = QDF_STATUS_E_FAILURE;
-		goto done;
+		goto err1;
 	}
 	lim_add_bcn_probe(session->vdev, frame.ptr, frame.len,
 			  freq, roam_sync_ind->rssi);
@@ -4341,9 +4341,8 @@ lim_gen_link_probe_rsp_roam(struct mac_context *mac_ctx,
 
 	gen_probe_rsp.ptr = qdf_mem_malloc(gen_frame_len);
 	if (!gen_probe_rsp.ptr) {
-		qdf_mem_free(probe_rsp);
 		status = QDF_STATUS_E_NOMEM;
-		goto done;
+		goto err1;
 	}
 
 	/*
@@ -4392,6 +4391,14 @@ lim_gen_link_probe_rsp_roam(struct mac_context *mac_ctx,
 			status = QDF_STATUS_E_FAILURE;
 			goto done;
 		}
+
+		if (gen_probe_rsp.len > gen_frame_len) {
+			pe_err("MLO: gen probe rsp len %u larger than buffer size: %u",
+			       gen_probe_rsp.len, gen_frame_len);
+			status = QDF_STATUS_E_FAILURE;
+			goto done;
+		}
+
 		lim_add_bcn_probe(session->vdev, gen_probe_rsp.ptr,
 				  gen_probe_rsp.len,
 				  mlo_roam_get_link_freq_from_mac_addr(
@@ -4401,6 +4408,7 @@ lim_gen_link_probe_rsp_roam(struct mac_context *mac_ctx,
 
 done:
 	qdf_mem_free(gen_probe_rsp.ptr);
+err1:
 	qdf_mem_free(probe_rsp);
 
 	if (QDF_IS_STATUS_ERROR(status)) {