Эх сурвалжийг харах

qcacmn: Add NULL checks to prevent invalid access

Currently, in few instances the MLO peer APIs are called
with invalid ML peer pointer.

This change prevents NULL pointer access and clears MLO
flag for peer.

Change-Id: I8bcdae1d71655f7ed267cc5bc3f6d0fc51e930df
CRs-Fixed: 3245158
Srinivas Pitla 3 жил өмнө
parent
commit
ce514f7963

+ 35 - 0
umac/mlo_mgr/src/wlan_mlo_mgr_peer.c

@@ -170,6 +170,9 @@ wlan_mlo_peer_is_disconnect_progress(struct wlan_mlo_peer_context *ml_peer)
 {
 {
 	QDF_STATUS status;
 	QDF_STATUS status;
 
 
+	if (!ml_peer)
+		return QDF_STATUS_E_FAILURE;
+
 	mlo_peer_lock_acquire(ml_peer);
 	mlo_peer_lock_acquire(ml_peer);
 
 
 	if (ml_peer->mlpeer_state == ML_PEER_DISCONN_INITIATED)
 	if (ml_peer->mlpeer_state == ML_PEER_DISCONN_INITIATED)
@@ -186,6 +189,9 @@ QDF_STATUS wlan_mlo_peer_is_assoc_done(struct wlan_mlo_peer_context *ml_peer)
 {
 {
 	QDF_STATUS status;
 	QDF_STATUS status;
 
 
+	if (!ml_peer)
+		return QDF_STATUS_E_FAILURE;
+
 	mlo_peer_lock_acquire(ml_peer);
 	mlo_peer_lock_acquire(ml_peer);
 
 
 	if (ml_peer->mlpeer_state == ML_PEER_ASSOC_DONE)
 	if (ml_peer->mlpeer_state == ML_PEER_ASSOC_DONE)
@@ -204,6 +210,9 @@ struct wlan_objmgr_peer *wlan_mlo_peer_get_assoc_peer(
 	struct wlan_mlo_link_peer_entry *peer_entry;
 	struct wlan_mlo_link_peer_entry *peer_entry;
 	struct wlan_objmgr_peer *assoc_peer = NULL;
 	struct wlan_objmgr_peer *assoc_peer = NULL;
 
 
+	if (!ml_peer)
+		return NULL;
+
 	mlo_peer_lock_acquire(ml_peer);
 	mlo_peer_lock_acquire(ml_peer);
 
 
 	peer_entry = &ml_peer->peer_list[0];
 	peer_entry = &ml_peer->peer_list[0];
@@ -260,6 +269,9 @@ void wlan_mlo_partner_peer_assoc_post(struct wlan_objmgr_peer *assoc_peer)
 	uint16_t i;
 	uint16_t i;
 
 
 	ml_peer = assoc_peer->mlo_peer_ctx;
 	ml_peer = assoc_peer->mlo_peer_ctx;
+	if (!ml_peer)
+		return;
+
 	mlo_peer_lock_acquire(ml_peer);
 	mlo_peer_lock_acquire(ml_peer);
 
 
 	if (ml_peer->mlpeer_state != ML_PEER_CREATED) {
 	if (ml_peer->mlpeer_state != ML_PEER_CREATED) {
@@ -308,6 +320,9 @@ wlan_mlo_peer_deauth_init(struct wlan_mlo_peer_context *ml_peer)
 	struct wlan_mlo_link_peer_entry *peer_entry;
 	struct wlan_mlo_link_peer_entry *peer_entry;
 	uint16_t i;
 	uint16_t i;
 
 
+	if (!ml_peer)
+		return;
+
 	mlo_peer_lock_acquire(ml_peer);
 	mlo_peer_lock_acquire(ml_peer);
 
 
 	if (ml_peer->mlpeer_state == ML_PEER_DISCONN_INITIATED) {
 	if (ml_peer->mlpeer_state == ML_PEER_DISCONN_INITIATED) {
@@ -365,6 +380,9 @@ wlan_mlo_partner_peer_create_failed_notify(
 	struct wlan_mlo_link_peer_entry *peer_entry;
 	struct wlan_mlo_link_peer_entry *peer_entry;
 	uint16_t i;
 	uint16_t i;
 
 
+	if (!ml_peer)
+		return;
+
 	mlo_peer_lock_acquire(ml_peer);
 	mlo_peer_lock_acquire(ml_peer);
 
 
 	if (ml_peer->mlpeer_state == ML_PEER_DISCONN_INITIATED) {
 	if (ml_peer->mlpeer_state == ML_PEER_DISCONN_INITIATED) {
@@ -477,6 +495,7 @@ static void mlo_reset_link_peer(
 {
 {
 	mlo_peer_lock_acquire(ml_peer);
 	mlo_peer_lock_acquire(ml_peer);
 	link_peer->mlo_peer_ctx = NULL;
 	link_peer->mlo_peer_ctx = NULL;
+	wlan_peer_clear_mlo(link_peer);
 	mlo_peer_lock_release(ml_peer);
 	mlo_peer_lock_release(ml_peer);
 }
 }
 
 
@@ -501,6 +520,10 @@ void mlo_peer_cleanup(struct wlan_mlo_peer_context *ml_peer)
 {
 {
 	struct wlan_mlo_dev_context *ml_dev;
 	struct wlan_mlo_dev_context *ml_dev;
 
 
+	if (!ml_peer) {
+		mlo_err("ML PEER is NULL");
+		return;
+	}
 	ml_dev = ml_peer->ml_dev;
 	ml_dev = ml_peer->ml_dev;
 	if (!ml_dev) {
 	if (!ml_dev) {
 		mlo_err("ML DEV is NULL");
 		mlo_err("ML DEV is NULL");
@@ -967,6 +990,9 @@ QDF_STATUS wlan_mlo_link_peer_attach(struct wlan_mlo_peer_context *ml_peer,
 	struct wlan_objmgr_peer *assoc_peer;
 	struct wlan_objmgr_peer *assoc_peer;
 	struct wlan_objmgr_vdev *vdev = NULL;
 	struct wlan_objmgr_vdev *vdev = NULL;
 
 
+	if (!ml_peer)
+		return QDF_STATUS_E_FAILURE;
+
 	vdev = wlan_peer_get_vdev(peer);
 	vdev = wlan_peer_get_vdev(peer);
 	if (!vdev)
 	if (!vdev)
 		return QDF_STATUS_E_FAILURE;
 		return QDF_STATUS_E_FAILURE;
@@ -1017,6 +1043,9 @@ qdf_nbuf_t mlo_peer_get_link_peer_assoc_req_buf(
 	struct wlan_objmgr_peer *peer = NULL;
 	struct wlan_objmgr_peer *peer = NULL;
 	qdf_nbuf_t assocbuf = NULL;
 	qdf_nbuf_t assocbuf = NULL;
 
 
+	if (!ml_peer)
+		return NULL;
+
 	peer = wlan_mlo_peer_get_assoc_peer(ml_peer);
 	peer = wlan_mlo_peer_get_assoc_peer(ml_peer);
 	if (!peer)
 	if (!peer)
 		return NULL;
 		return NULL;
@@ -1133,6 +1162,9 @@ bool wlan_mlo_peer_is_nawds(struct wlan_mlo_peer_context *ml_peer)
 {
 {
 	bool status = false;
 	bool status = false;
 
 
+	if (!ml_peer)
+		return status;
+
 	mlo_peer_lock_acquire(ml_peer);
 	mlo_peer_lock_acquire(ml_peer);
 	if (ml_peer->is_nawds_ml_peer)
 	if (ml_peer->is_nawds_ml_peer)
 		status = true;
 		status = true;
@@ -1165,6 +1197,9 @@ QDF_STATUS mlo_peer_link_auth_defer(struct wlan_mlo_peer_context *ml_peer,
 	struct mlpeer_auth_params *recv_auth;
 	struct mlpeer_auth_params *recv_auth;
 	QDF_STATUS status = QDF_STATUS_E_FAILURE;
 	QDF_STATUS status = QDF_STATUS_E_FAILURE;
 
 
+	if (!ml_peer)
+		return status;
+
 	mlo_peer_lock_acquire(ml_peer);
 	mlo_peer_lock_acquire(ml_peer);
 	for (i = 0; i < MAX_MLO_LINK_PEERS; i++) {
 	for (i = 0; i < MAX_MLO_LINK_PEERS; i++) {
 		recv_auth = ml_peer->pending_auth[i];
 		recv_auth = ml_peer->pending_auth[i];