Browse Source

qcacmn: Avoid NULL pointer dereference in send_packet_completion

If cds_dp_open fails during driver load time, cds_close is
called in clean up path. During cds_close, HTC cleanup happens
which makes target->hif_dev = NULL and in send_packet_completion
target->hif_dev is dereferenced without NULL check.

Add NULL check before dereferencing target->hif_dev during
send_packet_completion.

Change-Id: I236a083e194bf1f16d261e6334ac512c4f6bcd94
CRs-Fixed: 2625690
Alok Kumar 5 years ago
parent
commit
9cc180ec26
1 changed files with 2 additions and 2 deletions
  1. 2 2
      htc/htc_send.c

+ 2 - 2
htc/htc_send.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2019 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2020 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -129,7 +129,7 @@ static void send_packet_completion(HTC_TARGET *target, HTC_PACKET *pPacket)
 	 * In case of SSR, we cannot call the upper layer completion
 	 * callbacks, hence just free the nbuf and HTC packet here.
 	 */
-	if (hif_get_target_status(target->hif_dev)) {
+	if (target->hif_dev && hif_get_target_status(target->hif_dev)) {
 		htc_free_control_tx_packet(target, pPacket);
 		return;
 	}