Browse Source

qcacld-3.0: Pointer dereference and resource leak issue fix

Add changes to fix issues:
1. Read from pointer after free
2. Dereference before null check
3. Resource leak

Change-Id: Ie1b18abaa99e9ea168ded897e3f3e9c4cf33fb59
CRs-Fixed: 3295237
Amit Mehta 2 years ago
parent
commit
a518794bf5

+ 1 - 0
components/dp/core/src/wlan_dp_main.c

@@ -842,6 +842,7 @@ dp_peer_obj_create_notification(struct wlan_objmgr_peer *peer, void *arg)
 	if (QDF_IS_STATUS_ERROR(status)) {
 		dp_err("DP peer attach failed");
 		qdf_mem_free(sta_info);
+		return status;
 	}
 
 	qdf_mem_copy(sta_info->sta_mac.bytes, peer->macaddr,

+ 2 - 1
components/dp/core/src/wlan_dp_softap_txrx.c

@@ -216,7 +216,7 @@ int dp_post_dhcp_ind(struct wlan_dp_intf *dp_intf, uint8_t *mac_addr,
 		     bool dhcp_start)
 {
 	struct dp_dhcp_ind msg;
-	struct wlan_dp_psoc_sb_ops *sb_ops = &dp_intf->dp_ctx->sb_ops;
+	struct wlan_dp_psoc_sb_ops *sb_ops;
 	QDF_STATUS status = QDF_STATUS_SUCCESS;
 
 	dp_info("Post DHCP indication,sta_mac=" QDF_MAC_ADDR_FMT
@@ -227,6 +227,7 @@ int dp_post_dhcp_ind(struct wlan_dp_intf *dp_intf, uint8_t *mac_addr,
 		return QDF_STATUS_E_INVAL;
 	}
 
+	sb_ops = &dp_intf->dp_ctx->sb_ops;
 	msg.dhcp_start = dhcp_start;
 	msg.device_mode = dp_intf->device_mode;
 	qdf_mem_copy(msg.intf_mac_addr.bytes,

+ 7 - 6
os_if/dp/src/os_if_dp.c

@@ -1069,6 +1069,13 @@ int osif_dp_get_nud_stats(struct wiphy *wiphy,
 		goto exit;
 	}
 
+	arp_stats = ucfg_dp_get_arp_stats(vdev);
+	if (!arp_stats) {
+		dp_err("Unable to get ARP stats");
+		err = -EINVAL;
+		goto exit;
+	}
+
 	skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy,
 						  WLAN_NUD_STATS_LEN);
 	if (!skb) {
@@ -1076,12 +1083,6 @@ int osif_dp_get_nud_stats(struct wiphy *wiphy,
 		err = -ENOMEM;
 		goto exit;
 	}
-	arp_stats = ucfg_dp_get_arp_stats(vdev);
-	if (!arp_stats) {
-		dp_err("Unable to get ARP stats");
-		err = -EINVAL;
-		goto exit;
-	}
 
 	if (nla_put_u16(skb, COUNT_FROM_NETDEV,
 			arp_stats->tx_arp_req_count) ||