diff options
| author | Manishekar Chandrasekaran <cmshekar@codeaurora.org> | 2016-06-23 08:36:49 +0530 |
|---|---|---|
| committer | Vishwajith Upendra <vishwaji@codeaurora.org> | 2016-06-24 14:30:50 -0700 |
| commit | d79c4e6cfa11dc0e5f93317ec70a5f587dca29da (patch) | |
| tree | d31d31a475aaf946d9e4e2a45dc4256b9e7e207f | |
| parent | f7a1dad7e028adc03a07eacf3e8731346177022e (diff) | |
qcacld-3.0: Sanitize SAP context before extracting the handle
Ensure that the SAP context is sanitized before extracting
the global handle. The context passed in the callback could
be freed by the time it is accessed.
Change-Id: I4a08717abce2a0ecbe4055360fd8d31c3e50a701
CRs-Fixed: 1031855
| -rw-r--r-- | core/sap/src/sap_api_link_cntl.c | 19 |
1 files changed, 10 insertions, 9 deletions
diff --git a/core/sap/src/sap_api_link_cntl.c b/core/sap/src/sap_api_link_cntl.c index 43ccbf2edb4a..d0b3a00582c0 100644 --- a/core/sap/src/sap_api_link_cntl.c +++ b/core/sap/src/sap_api_link_cntl.c @@ -808,25 +808,26 @@ wlansap_roam_callback(void *ctx, tCsrRoamInfo *csr_roam_info, uint32_t roamId, eRoamCmdStatus roam_status, eCsrRoamResult roam_result) { /* sap_ctx value */ - ptSapContext sap_ctx = (ptSapContext) ctx; + ptSapContext sap_ctx; /* State machine event */ tWLAN_SAPEvent sap_event; QDF_STATUS qdf_status = QDF_STATUS_SUCCESS; QDF_STATUS qdf_ret_status = QDF_STATUS_SUCCESS; - tHalHandle hal = CDS_GET_HAL_CB(sap_ctx->p_cds_gctx); + tHalHandle hal; tpAniSirGlobal mac_ctx = NULL; uint8_t intf; - if (NULL == hal) { + if (QDF_IS_STATUS_ERROR(wlansap_context_get((ptSapContext)ctx))) + return QDF_STATUS_E_FAILURE; + + sap_ctx = (ptSapContext) ctx; + hal = CDS_GET_HAL_CB(sap_ctx->p_cds_gctx); + if (!hal) { QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_ERROR, - FL("Invalid hal")); - qdf_ret_status = QDF_STATUS_E_NOMEM; - return qdf_ret_status; + FL("Invalid handle")); + return QDF_STATUS_E_NOMEM; } - if (QDF_IS_STATUS_ERROR(wlansap_context_get(sap_ctx))) - return QDF_STATUS_E_FAILURE; - mac_ctx = PMAC_STRUCT(hal); QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_INFO_HIGH, FL("Before switch on roam_status = %d\n"), roam_status); |