android/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Avoid NULL pointer dereferenced

Browse Source 
Pointer 'pre_cac_adapter' returned from call to function
'hdd_get_adapter_by_iface_name' may be NULL and may be
dereferenced.
Array '&param_val' of size 4 may use index value(s) large
than 4.

Change-Id: Ic66628f79a6118bc5ab4d6571f341b80e18c689b
CRs-Fixed: 3559886
This commit is contained in:
Chunquan Luo 2023-07-13 03:47:13 -07:00 committed by Rahul Choudhary
parent 8d6557a26d
commit 05133482ca
2 changed files with 41 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
core/hdd/src/wlan_hdd_pre_cac.c
View File

@ -234,11 +234,16 @@ static int __wlan_hdd_request_pre_cac(struct hdd_context *hdd_ctx,
pre_cac_adapter = hdd_get_adapter_by_iface_name(hdd_ctx,
SAP_PRE_CAC_IFNAME);
if (!pre_cac_adapter &&
(policy_mgr_get_connection_count(hdd_ctx->psoc) > 1)) {
if (!pre_cac_adapter) {
hdd_err("error opening the pre cac adapter");
return -EINVAL;
}
if (policy_mgr_get_connection_count(hdd_ctx->psoc) > 1) {
hdd_err("pre cac not allowed in concurrency");
return -EINVAL;
}
pre_cac_link_info = pre_cac_adapter->deflink;
ap_adapter = hdd_get_adapter(hdd_ctx, QDF_SAP_MODE);
@ -281,7 +286,6 @@ static int __wlan_hdd_request_pre_cac(struct hdd_context *hdd_ctx,
hdd_debug("starting pre cac SAP adapter");
if (!pre_cac_adapter) {
mac_addr = wlan_hdd_get_intf_addr(hdd_ctx, QDF_SAP_MODE);
if (!mac_addr) {
hdd_err("can't add virtual intf: Not getting valid mac addr");
@ -317,7 +321,6 @@ static int __wlan_hdd_request_pre_cac(struct hdd_context *hdd_ctx,
hdd_err("error opening the pre cac adapter");
goto release_intf_addr_and_return_failure;
}
}
pre_cac_ap_ctx = WLAN_HDD_GET_AP_CTX_PTR(pre_cac_link_info);
sap_clear_global_dfs_param(mac_handle, pre_cac_ap_ctx->sap_context);

2
core/sme/src/common/sme_api.c
View File

@ -11068,7 +11068,7 @@ int sme_send_he_om_ctrl_update(mac_handle_t mac_handle, uint8_t session_id,
sme_debug("EHT OMI: BW %d rx nss %d tx nss %d", omi_data->eht_ch_bw_ext,
omi_data->eht_rx_nss_ext, omi_data->eht_tx_nss_ext);
qdf_mem_copy(&param_val, omi_data, sizeof(omi_data));
qdf_mem_copy(&param_val, omi_data, sizeof(param_val));
wlan_mlme_get_bssid_vdev_id(mac_ctx->pdev, session_id,
&connected_bssid);
sme_debug("param val %08X, bssid:"QDF_MAC_ADDR_FMT, param_val,