qcacmn: NULL pointer dereference in free_htc_bundle_packet()
Inside free_htc_bundle_packet() if the HTC packet queue associated with a packet is NULL, a NULL pointer dereference can occur. Add check to verify that HTC packet queue is not NULL before dereferencing. Change-Id: I1965a66de74b8954fdc59733e5ef86120f4f8898 Crs-Fixed: 2232839
This commit is contained in:
@@ -230,9 +230,13 @@ void free_htc_bundle_packet(HTC_TARGET *target, HTC_PACKET *pPacket)
|
||||
|
||||
/* restore queue */
|
||||
pQueueSave = (HTC_PACKET_QUEUE *) pPacket->pContext;
|
||||
AR_DEBUG_ASSERT(pQueueSave);
|
||||
|
||||
INIT_HTC_PACKET_QUEUE(pQueueSave);
|
||||
if (qdf_unlikely(!pQueueSave)) {
|
||||
AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
|
||||
("\n%s: Invalid pQueueSave in HTC Packet\n",
|
||||
__func__));
|
||||
AR_DEBUG_ASSERT(pQueueSave);
|
||||
} else
|
||||
INIT_HTC_PACKET_QUEUE(pQueueSave);
|
||||
|
||||
LOCK_HTC_TX(target);
|
||||
if (target->pBundleFreeList == NULL) {
|
||||
|
Reference in New Issue
Block a user