qcacld-3.0: Pointer dereference and resource leak issue fix

Add changes to fix issues:
1. Read from pointer after free
2. Dereference before null check
3. Resource leak

Change-Id: Ie1b18abaa99e9ea168ded897e3f3e9c4cf33fb59
CRs-Fixed: 3295237
This commit is contained in:
Amit Mehta
2022-09-20 08:42:18 -07:00
committato da Madan Koyyalamudi
parent 09e7520da2
commit a518794bf5
3 ha cambiato i file con 10 aggiunte e 7 eliminazioni

Vedi File

@@ -842,6 +842,7 @@ dp_peer_obj_create_notification(struct wlan_objmgr_peer *peer, void *arg)
if (QDF_IS_STATUS_ERROR(status)) {
dp_err("DP peer attach failed");
qdf_mem_free(sta_info);
return status;
}
qdf_mem_copy(sta_info->sta_mac.bytes, peer->macaddr,

Vedi File

@@ -216,7 +216,7 @@ int dp_post_dhcp_ind(struct wlan_dp_intf *dp_intf, uint8_t *mac_addr,
bool dhcp_start)
{
struct dp_dhcp_ind msg;
struct wlan_dp_psoc_sb_ops *sb_ops = &dp_intf->dp_ctx->sb_ops;
struct wlan_dp_psoc_sb_ops *sb_ops;
QDF_STATUS status = QDF_STATUS_SUCCESS;
dp_info("Post DHCP indication,sta_mac=" QDF_MAC_ADDR_FMT
@@ -227,6 +227,7 @@ int dp_post_dhcp_ind(struct wlan_dp_intf *dp_intf, uint8_t *mac_addr,
return QDF_STATUS_E_INVAL;
}
sb_ops = &dp_intf->dp_ctx->sb_ops;
msg.dhcp_start = dhcp_start;
msg.device_mode = dp_intf->device_mode;
qdf_mem_copy(msg.intf_mac_addr.bytes,

Vedi File

@@ -1069,6 +1069,13 @@ int osif_dp_get_nud_stats(struct wiphy *wiphy,
goto exit;
}
arp_stats = ucfg_dp_get_arp_stats(vdev);
if (!arp_stats) {
dp_err("Unable to get ARP stats");
err = -EINVAL;
goto exit;
}
skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy,
WLAN_NUD_STATS_LEN);
if (!skb) {
@@ -1076,12 +1083,6 @@ int osif_dp_get_nud_stats(struct wiphy *wiphy,
err = -ENOMEM;
goto exit;
}
arp_stats = ucfg_dp_get_arp_stats(vdev);
if (!arp_stats) {
dp_err("Unable to get ARP stats");
err = -EINVAL;
goto exit;
}
if (nla_put_u16(skb, COUNT_FROM_NETDEV,
arp_stats->tx_arp_req_count) ||