diff options
| author | gaurank kathpalia <gkathpal@codeaurora.org> | 2018-07-05 20:33:16 +0530 |
|---|---|---|
| committer | nshrivas <nshrivas@codeaurora.org> | 2018-07-07 23:47:24 -0700 |
| commit | a00dfccff5c0226366cf03939b6ba0c40600d9af (patch) | |
| tree | 726035843ab5d76c18ddbf8e964e1dcfe2857d96 | |
| parent | c254348c672e0217eb997ab37505b09d618495e9 (diff) | |
qcacld-3.0: Fix KW issue in hdd_sme_roam_callback
The driver may dereference pRoamInfo by calling APIs
in hdd_sme_roam_callback which have arguements of
structure tagCsrRoamInfo.
Fix is to have a check for pRoamInfo, and then only
pass its struct members as arguments to other API.
Change-Id: I28acee0ff42a50221f6dbef7af4b9c04dd6e8d1e
CRs-Fixed: 2259290
| -rw-r--r-- | core/hdd/src/wlan_hdd_assoc.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/core/hdd/src/wlan_hdd_assoc.c b/core/hdd/src/wlan_hdd_assoc.c index 2254c4a7e916..98b3da92e7da 100644 --- a/core/hdd/src/wlan_hdd_assoc.c +++ b/core/hdd/src/wlan_hdd_assoc.c @@ -5320,16 +5320,19 @@ hdd_sme_roam_callback(void *pContext, tCsrRoamInfo *pRoamInfo, uint32_t roamId, roamResult); break; case eCSR_ROAM_RESULT_MGMT_TX_COMPLETE_IND: - wlan_hdd_tdls_mgmt_completion_callback(pAdapter, + if (pRoamInfo) + wlan_hdd_tdls_mgmt_completion_callback(pAdapter, pRoamInfo->reasonCode); break; case eCSR_ROAM_TDLS_SET_STATE_DISABLE: - hdd_tdls_notify_set_state_disable(pRoamInfo->sessionId); + if (pRoamInfo) + hdd_tdls_notify_set_state_disable(pRoamInfo->sessionId); break; #endif #ifdef WLAN_FEATURE_11W case eCSR_ROAM_UNPROT_MGMT_FRAME_IND: - hdd_indicate_unprot_mgmt_frame(pAdapter, + if (pRoamInfo) + hdd_indicate_unprot_mgmt_frame(pAdapter, pRoamInfo->nFrameLength, pRoamInfo->pbFrames, pRoamInfo->frameType); @@ -5337,7 +5340,8 @@ hdd_sme_roam_callback(void *pContext, tCsrRoamInfo *pRoamInfo, uint32_t roamId, #endif #ifdef FEATURE_WLAN_ESE case eCSR_ROAM_TSM_IE_IND: - hdd_indicate_tsm_ie(pAdapter, pRoamInfo->tsmIe.tsid, + if (pRoamInfo) + hdd_indicate_tsm_ie(pAdapter, pRoamInfo->tsmIe.tsid, pRoamInfo->tsmIe.state, pRoamInfo->tsmIe.msmt_interval); break; |