Explorar el Código

qcacld-3.0: Rectify deinit sequence leading to NULL ptr dereference

In function hdd_wlan_de_init, the hdd_context is fetched via
cds_get_context. This context is then NULL checked. In the failure case
of this check, the hdd_context is still dereferenced which shall lead to
null pointer dereference.

Add proper jump statement to take care of the proper order of init and
deinit

Change-Id: Ied0ac42371315d0286cdcc71e6e0e10ed2ff5fa1
CRs-Fixed: 2299794
Sourav Mohapatra hace 6 años
padre
commit
b1260134ad
Se han modificado 1 ficheros con 9 adiciones y 9 borrados
  1. 9 9
      core/hdd/src/wlan_hdd_power.c

+ 9 - 9
core/hdd/src/wlan_hdd_power.c

@@ -1312,7 +1312,7 @@ QDF_STATUS hdd_wlan_re_init(void)
 	hdd_ctx = cds_get_context(QDF_MODULE_ID_HDD);
 	if (!hdd_ctx) {
 		hdd_err("HDD context is Null");
-		goto err_re_init;
+		goto err_ctx_null;
 	}
 	bug_on_reinit_failure = hdd_ctx->config->bug_on_reinit_failure;
 
@@ -1356,23 +1356,23 @@ QDF_STATUS hdd_wlan_re_init(void)
 
 	hdd_send_default_scan_ies(hdd_ctx);
 	hdd_info("WLAN host driver reinitiation completed!");
-	goto success;
+
+	if (hdd_ctx->config->sap_internal_restart)
+		hdd_ssr_restart_sap(hdd_ctx);
+
+	hdd_wlan_ssr_reinit_event();
+	return QDF_STATUS_SUCCESS;
 
 err_re_init:
 	hdd_bus_bandwidth_deinit(hdd_ctx);
 	qdf_dp_trace_deinit();
+
+err_ctx_null:
 	/* Allow the phone to go to sleep */
 	hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_DRIVER_REINIT);
 	if (bug_on_reinit_failure)
 		QDF_BUG(0);
 	return -EPERM;
-
-success:
-	if (hdd_ctx->config->sap_internal_restart)
-		hdd_ssr_restart_sap(hdd_ctx);
-
-	hdd_wlan_ssr_reinit_event();
-	return QDF_STATUS_SUCCESS;
 }
 
 int wlan_hdd_set_powersave(struct hdd_adapter *adapter,