Ver Fonte

qcacld-3.0: Check for valid vdev_id in wma_is_roam_in_progress

When kickout event is received from firmware, the function
wma_is_roam_in_progress is called to check the roaming in
progress using vdev_id .

Vdev_id needs to be checked for valid vdev_id prior to
derefencing it.

Change-Id: Ib56895ad73b5dcefe7a0b9f65089306bf42d78eb
CRs-Fixed: 3020665
Deeksha Gupta há 3 anos atrás
pai
commit
b13cd6fade
2 ficheiros alterados com 7 adições e 0 exclusões
  1. 3 0
      core/wma/src/wma_data.c
  2. 4 0
      core/wma/src/wma_mgmt.c

+ 3 - 0
core/wma/src/wma_data.c

@@ -3168,6 +3168,9 @@ bool wma_is_roam_in_progress(uint32_t vdev_id)
 	tp_wma_handle wma = cds_get_context(QDF_MODULE_ID_WMA);
 	enum QDF_OPMODE opmode;
 
+	if (!wma_is_vdev_valid(vdev_id))
+		return false;
+
 	if (!wma || !wma->interfaces[vdev_id].vdev)
 		return false;
 

+ 4 - 0
core/wma/src/wma_mgmt.c

@@ -344,6 +344,10 @@ int wma_peer_sta_kickout_event_handler(void *handle, uint8_t *event,
 			 QDF_MAC_ADDR_REF(macaddr));
 		return -EINVAL;
 	}
+
+	if (!wma_is_vdev_valid(vdev_id))
+		return -EINVAL;
+
 	vdev = wma->interfaces[vdev_id].vdev;
 	if (!vdev) {
 		wma_err("Not able to find vdev for VDEV_%d", vdev_id);