Browse Source

qcacld-3.0: Check NULL pointer of roam_profile

__wlan_hdd_cfg80211_get_key was invoked when unloading driver.
SAP ctx had been freed at this time.wlan_sap_get_roam_profile will
return NULL.
Check NULL pointer before use roam_profile.

Change-Id: If1f11f0fb7027a6af4e3242fe9af722740d32850
CRs-Fixed: 2162395
Jiachao Wu 7 years ago
parent
commit
d58cfc9eee
1 changed files with 10 additions and 0 deletions
  1. 10 0
      core/hdd/src/wlan_hdd_cfg80211.c

+ 10 - 0
core/hdd/src/wlan_hdd_cfg80211.c

@@ -14650,6 +14650,11 @@ static int __wlan_hdd_cfg80211_get_key(struct wiphy *wiphy,
 		return -EINVAL;
 		return -EINVAL;
 	}
 	}
 
 
+	if (wlan_hdd_validate_session_id(adapter->session_id)) {
+		hdd_err("Invalid session id: %d", adapter->session_id);
+		return -EINVAL;
+	}
+
 	hdd_debug("Device_mode %s(%d)",
 	hdd_debug("Device_mode %s(%d)",
 		hdd_device_mode_to_string(adapter->device_mode),
 		hdd_device_mode_to_string(adapter->device_mode),
 		adapter->device_mode);
 		adapter->device_mode);
@@ -14673,6 +14678,11 @@ static int __wlan_hdd_cfg80211_get_key(struct wiphy *wiphy,
 		roam_profile = &(pWextState->roamProfile);
 		roam_profile = &(pWextState->roamProfile);
 	}
 	}
 
 
+	if (roam_profile == NULL) {
+		hdd_err("Get roam profile failed!");
+		return -EINVAL;
+	}
+
 	switch (roam_profile->EncryptionType.encryptionType[0]) {
 	switch (roam_profile->EncryptionType.encryptionType[0]) {
 	case eCSR_ENCRYPT_TYPE_NONE:
 	case eCSR_ENCRYPT_TYPE_NONE:
 		params.cipher = IW_AUTH_CIPHER_NONE;
 		params.cipher = IW_AUTH_CIPHER_NONE;