浏览代码

qcacld-3.0: Fix potential NULL ptr dereference in if_mgr

The peer objmgr pointer in the if_mgr_roam module may be NULL if
there is no peer connected. Add check to see if pointer is NULL
before dereferencing it. Also modify logic to only check if the
vdev is in STA or P2P_CLI mode.

Change-Id: I7370ca5b9c74bd81f6e958cf740b6ee426f4faad
CRs-fixed: 2779831
Lincoln Tran 4 年之前
父节点
当前提交
d3f63c4fe8
共有 1 个文件被更改,包括 18 次插入3 次删除
  1. 18 3
      components/cmn_services/interface_mgr/src/wlan_if_mgr_roam.c

+ 18 - 3
components/cmn_services/interface_mgr/src/wlan_if_mgr_roam.c

@@ -192,12 +192,27 @@ static void if_mgr_get_vdev_id_from_bssid(struct wlan_objmgr_pdev *pdev,
 {
 	struct bssid_search_arg *bssid_arg = arg;
 	struct wlan_objmgr_vdev *vdev = (struct wlan_objmgr_vdev *)object;
-	struct wlan_objmgr_vdev_objmgr *objmgr = &vdev->vdev_objmgr;
-	struct wlan_objmgr_peer *peer = objmgr->bss_peer;
+	struct wlan_objmgr_peer *peer;
+
+	if (!(wlan_vdev_mlme_get_opmode(vdev) == QDF_STA_MODE ||
+	      wlan_vdev_mlme_get_opmode(vdev) == QDF_P2P_CLIENT_MODE))
+		return;
+
+	/* Need to check the connection manager state when that becomes
+	 * available
+	 */
+	if (wlan_vdev_mlme_get_state(vdev) != WLAN_VDEV_S_UP)
+		return;
+
+	peer = wlan_objmgr_vdev_try_get_bsspeer(vdev, WLAN_IF_MGR_ID);
+	if (!peer)
+		return;
 
 	if (WLAN_ADDR_EQ(bssid_arg->peer_addr.bytes,
-			 wlan_peer_get_macaddr(peer)))
+			 wlan_peer_get_macaddr(peer)) == QDF_STATUS_SUCCESS)
 		bssid_arg->vdev_id = wlan_vdev_get_id(vdev);
+
+	wlan_objmgr_peer_release_ref(peer, WLAN_IF_MGR_ID);
 }
 
 QDF_STATUS if_mgr_validate_candidate(struct wlan_objmgr_vdev *vdev,