samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Fix NULL pointer dereference when out of buffers

Browse Source 
When util_scan_copy_cache_entry return NULL for out of buffers,
NULL pointer dereference happens.

To fix it, check return pointer of util_scan_copy_cache_entry
before use it.

Change-Id: Iec5e6f10c8e0bbe6b88d844cc00320f3f23191a4
CRs-Fixed: 3885075
This commit is contained in:
Jianmin Zhu
2024-07-31 12:17:30 +08:00
committed by Ravindra Konda
parent 9e1ef54291
commit ee88dcad93
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
umac/mlme/connection_mgr/core/src/wlan_cm_bss_scoring.c
View File

@@ -3020,6 +3020,11 @@ cm_add_11_ax_candidate(struct wlan_objmgr_pdev *pdev,
struct scan_cache_entry *tmp_scan_entry = NULL; struct scan_cache_entry *tmp_scan_entry = NULL;
tmp_scan_entry = util_scan_copy_cache_entry(scan_entry->entry); tmp_scan_entry = util_scan_copy_cache_entry(scan_entry->entry);
if (!tmp_scan_entry) {
mlme_err("Copy cache entry failed");
return;
}
/* Add 11AX entry for MLO Candidate */ /* Add 11AX entry for MLO Candidate */
if (!tmp_scan_entry->ie_list.multi_link_bv) { if (!tmp_scan_entry->ie_list.multi_link_bv) {
util_scan_free_cache_entry(tmp_scan_entry); util_scan_free_cache_entry(tmp_scan_entry);