qcacmn: NULL pointer dereference in free_htc_bundle_packet()

Inside free_htc_bundle_packet() if the HTC packet queue
associated with a packet is NULL, a NULL pointer dereference
can occur.

Add check to verify that HTC packet queue is not NULL before
dereferencing.

Change-Id: I1965a66de74b8954fdc59733e5ef86120f4f8898
Crs-Fixed: 2232839
This commit is contained in:
jitiphil
2018-05-11 16:14:38 +05:30
zatwierdzone przez nshrivas
rodzic e6168d475d
commit fcc2488d25

Wyświetl plik

@@ -230,9 +230,13 @@ void free_htc_bundle_packet(HTC_TARGET *target, HTC_PACKET *pPacket)
/* restore queue */
pQueueSave = (HTC_PACKET_QUEUE *) pPacket->pContext;
AR_DEBUG_ASSERT(pQueueSave);
INIT_HTC_PACKET_QUEUE(pQueueSave);
if (qdf_unlikely(!pQueueSave)) {
AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
("\n%s: Invalid pQueueSave in HTC Packet\n",
__func__));
AR_DEBUG_ASSERT(pQueueSave);
} else
INIT_HTC_PACKET_QUEUE(pQueueSave);
LOCK_HTC_TX(target);
if (target->pBundleFreeList == NULL) {