diff options
| author | Sandeep Puligilla <spuligil@codeaurora.org> | 2016-11-02 18:28:34 -0700 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2016-11-03 19:33:11 -0700 |
| commit | fd07e6fe9cca701df9cdec8acddff8d11dacae7f (patch) | |
| tree | 6a246f080af76e7c74bfeb82ac4ebf31e1d08e4a | |
| parent | 45cc8b794a7fcb1a9b4beb1ff953b54f369146b8 (diff) | |
qcacld-3.0: Fix null pointer dereference
During roaming join request pointer in the session
is not initilized and the same pointer gets dereferenced
as part of the heart beat timeout handler.
Add validation check before accessing the join request holder
in the session.
Change-Id: I92a4f13a611b9e8eb11dac1194e52ddd726dbc41
CRs-Fixed: 1084701
| -rw-r--r-- | core/mac/src/pe/lim/lim_link_monitoring_algo.c | 21 |
1 files changed, 16 insertions, 5 deletions
diff --git a/core/mac/src/pe/lim/lim_link_monitoring_algo.c b/core/mac/src/pe/lim/lim_link_monitoring_algo.c index 57f00e48abd3..4f678f3d5c45 100644 --- a/core/mac/src/pe/lim/lim_link_monitoring_algo.c +++ b/core/mac/src/pe/lim/lim_link_monitoring_algo.c @@ -434,6 +434,7 @@ void lim_handle_heart_beat_failure(tpAniSirGlobal mac_ctx, tpPESession session) { uint8_t curr_chan; + tpSirAddie scan_ie = NULL; #ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM /* FEATURE_WLAN_DIAG_SUPPORT */ host_log_beacon_update_pkt_type *log_ptr = NULL; @@ -489,11 +490,21 @@ void lim_handle_heart_beat_failure(tpAniSirGlobal mac_ctx, lim_log(mac_ctx, LOGW, FL("HB missed from AP. Sending Probe Req")); /* for searching AP, we don't include any more IE */ - lim_send_probe_req_mgmt_frame(mac_ctx, &session->ssId, - session->bssId, curr_chan, session->selfMacAddr, - session->dot11mode, - session->pLimJoinReq->addIEScan.length, - session->pLimJoinReq->addIEScan.addIEdata); + if (session->pLimJoinReq != NULL) { + scan_ie = &session->pLimJoinReq->addIEScan; + lim_send_probe_req_mgmt_frame(mac_ctx, + &session->ssId, + session->bssId, curr_chan, + session->selfMacAddr, + session->dot11mode, + scan_ie->length, scan_ie->addIEdata); + } else { + lim_send_probe_req_mgmt_frame(mac_ctx, + &session->ssId, + session->bssId, curr_chan, + session->selfMacAddr, + session->dot11mode, 0, NULL); + } } else { lim_log(mac_ctx, LOGW, FL("HB missed from AP on DFS chanel moving to passive")); |