浏览代码

qcacld-3.0: Null check while calling md_host_evt_cb

wma_motion_det_host_event_handler() get called when FW sent
WMI_MOTION_DET_HOST_EVENTID message.
After the initial processing, pmac->sme.md_host_evt_cb() is
called to send the relevant data back up to the upper layers
of WLAN.
Since this callback function is dynamically registered there
are cases where it might not be registered before this FW event
is received, resulting in a NULL pointer dereference.

Change-Id: I06b7907b39f4da0837196ccf377ecc2da325be8c
CRs-Fixed: 2428803
Harprit Chhabada 6 年之前
父节点
当前提交
c67478f0d7
共有 1 个文件被更改,包括 5 次插入0 次删除
  1. 5 0
      core/wma/src/wma_main.c

+ 5 - 0
core/wma/src/wma_main.c

@@ -8018,6 +8018,11 @@ int wma_motion_det_host_event_handler(void *handle, uint8_t *event,
 		return -EINVAL;
 	}
 
+	if (!pmac || !pmac->sme.md_host_evt_cb) {
+		WMA_LOGE("Invalid motion detect callback");
+		return -EINVAL;
+	}
+
 	motion_det_event_hdr = param_buf->fixed_param;
 	WMA_LOGA("motion detect host event received, vdev_id=%d, status=%d",
 		 motion_det_event_hdr->vdev_id, motion_det_event_hdr->status);