qcacld-3.0: Add null pointer validation in wma_ll_stats_evt_handler()

Add validation code in wma_ll_stats_evt_handler().

Change-Id: I7d0331ce18b16650540724917194defaf65aed10
CRs-Fixed: 2348596

core/wma/src/wma_utils.c

@@ -1080,7 +1080,6 @@ static int wma_ll_stats_evt_handler(void *handle, u_int8_t *event,
 	tSirLLStatsResults *link_stats_results;
 	wmi_chan_cca_stats *wmi_cca_stats;
 	wmi_peer_signal_stats *wmi_peer_signal;
-	wmi_peer_ac_rx_stats *wmi_peer_rx;
 	struct sir_wifi_ll_ext_stats *ll_stats;
 	struct sir_wifi_ll_ext_peer_stats *peer_stats;
 	struct sir_wifi_chan_cca_stats *cca_stats;
@@ -1108,7 +1107,6 @@ static int wma_ll_stats_evt_handler(void *handle, u_int8_t *event,
 	fixed_param = param_buf->fixed_param;
 	wmi_cca_stats = param_buf->chan_cca_stats;
 	wmi_peer_signal = param_buf->peer_signal_stats;
-	wmi_peer_rx = param_buf->peer_ac_rx_stats;
 	if (fixed_param->num_peer_signal_stats >
 		param_buf->num_peer_signal_stats ||
 		fixed_param->num_peer_ac_tx_stats >
@@ -1155,10 +1153,14 @@ static int wma_ll_stats_evt_handler(void *handle, u_int8_t *event,
 	ll_stats->peer_num = peer_num;
 
 	result = (uint8_t *)ll_stats->stats;
+	if (!result) {
+		WMA_LOGE("%s: result is null", __func__);
+		return -EINVAL;
+	}
 	peer_stats = (struct sir_wifi_ll_ext_peer_stats *)result;
 	ll_stats->peer_stats = peer_stats;
 
-	for (i = 0; i < peer_num; i++) {
+	for (i = 0; i < peer_num && peer_stats; i++) {
 		peer_stats[i].peer_id = WIFI_INVALID_PEER_ID;
 		peer_stats[i].vdev_id = WIFI_INVALID_VDEV_ID;
 	}
@@ -1166,7 +1168,10 @@ static int wma_ll_stats_evt_handler(void *handle, u_int8_t *event,
 	/* Per peer signal */
 	result_size -= sizeof(struct sir_wifi_ll_ext_stats);
 	dst_len = sizeof(struct sir_wifi_peer_signal_stats);
-	for (i = 0; i < fixed_param->num_peer_signal_stats; i++) {
+	for (i = 0;
+	     i < fixed_param->num_peer_signal_stats &&
+	     peer_stats && wmi_peer_signal;
+	     i++) {
 		peer_stats[i].peer_id = wmi_peer_signal->peer_id;
 		peer_stats[i].vdev_id = wmi_peer_signal->vdev_id;
 		peer_signal = &peer_stats[i].peer_signal_stats;
@@ -1174,7 +1179,7 @@ static int wma_ll_stats_evt_handler(void *handle, u_int8_t *event,
 		WMA_LOGD("%d antennas for peer %d",
 			 wmi_peer_signal->num_chains_valid,
 			 wmi_peer_signal->peer_id);
-		if (dst_len <= result_size) {
+		if (dst_len <= result_size && peer_signal) {
 			peer_signal->vdev_id = wmi_peer_signal->vdev_id;
 			peer_signal->peer_id = wmi_peer_signal->peer_id;
 			peer_signal->num_chain =
@@ -1201,15 +1206,30 @@ static int wma_ll_stats_evt_handler(void *handle, u_int8_t *event,
 	result += peer_num * sizeof(struct sir_wifi_ll_ext_peer_stats);
 	cca_stats = (struct sir_wifi_chan_cca_stats *)result;
 	ll_stats->cca = cca_stats;
-	dst_len = sizeof(struct sir_wifi_chan_cca_stats);
-	for (i = 0; i < ll_stats->channel_num; i++) {
+	dst_len = sizeof(*cca_stats);
+	for (i = 0;
+	     i < ll_stats->channel_num && cca_stats && wmi_cca_stats;
+	     i++) {
 		if (dst_len <= result_size) {
-			qdf_mem_copy(&cca_stats[i], &wmi_cca_stats->vdev_id,
-				     dst_len);
+			cca_stats->vdev_id = wmi_cca_stats->vdev_id;
+			cca_stats->idle_time = wmi_cca_stats->idle_time;
+			cca_stats->tx_time = wmi_cca_stats->tx_time;
+			cca_stats->rx_in_bss_time =
+				wmi_cca_stats->rx_in_bss_time;
+			cca_stats->rx_out_bss_time =
+				wmi_cca_stats->rx_out_bss_time;
+			cca_stats->rx_busy_time = wmi_cca_stats->rx_busy_time;
+			cca_stats->rx_in_bad_cond_time =
+				wmi_cca_stats->rx_in_bad_cond_time;
+			cca_stats->tx_in_bad_cond_time =
+				wmi_cca_stats->tx_in_bad_cond_time;
+			cca_stats->wlan_not_avail_time =
+				wmi_cca_stats->wlan_not_avail_time;
 			result_size -= dst_len;
 		} else {
 			WMA_LOGE(FL("Invalid length of CCA."));
 		}
+		cca_stats++;
 	}
 
 	result += i * sizeof(struct sir_wifi_chan_cca_stats);