diff options
| author | Himanshu Agarwal <himanaga@codeaurora.org> | 2016-09-08 18:54:47 +0530 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2016-09-10 19:08:39 -0700 |
| commit | f03f81036d4ccee76918e71a5c3f8a50c233cea1 (patch) | |
| tree | 8675762e94e1a094939411222f493bd838f31767 /core/dp/htt | |
| parent | 863e29e77809ad1ffb00c1216b6422fec6c493d2 (diff) | |
qcacld-3.0: Fix NULL pointer dereferencing issues
Fix below issues:
1) check cds_get_context results before use
2) remove function calls from ASSERTs
3) make sure variables are initialized before use
4) check pointers for NULL before dereferencing
Change-Id: Iac92e6f2d1030a7dd12469e34341135bea7c781f
CRs-Fixed: 1047286
(cherry picked from commit a2547fd35fc517abfbc96363768b5d036d59d057)
Diffstat (limited to 'core/dp/htt')
| -rw-r--r-- | core/dp/htt/htt_tx.c | 47 |
1 files changed, 28 insertions, 19 deletions
diff --git a/core/dp/htt/htt_tx.c b/core/dp/htt/htt_tx.c index 8c6271b7ac58..3a1539e4140f 100644 --- a/core/dp/htt/htt_tx.c +++ b/core/dp/htt/htt_tx.c @@ -1599,11 +1599,21 @@ htt_tx_desc_init(htt_pdev_handle pdev, void *qdf_ctx = cds_get_context(QDF_MODULE_ID_QDF_DEVICE); QDF_STATUS status; - if (!qdf_ctx) { + if (qdf_unlikely(!qdf_ctx)) { QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR, "%s: qdf_ctx is NULL", __func__); return; } + if (qdf_unlikely(!msdu_info)) { + QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR, + "%s: bad arg: msdu_info is NULL", __func__); + return; + } + if (qdf_unlikely(!tso_info)) { + QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR, + "%s: bad arg: tso_info is NULL", __func__); + return; + } word0 = (uint32_t *) htt_tx_desc; word1 = word0 + 1; @@ -1639,24 +1649,23 @@ htt_tx_desc_init(htt_pdev_handle pdev, */ local_word0 = 0; - if (msdu_info) { - HTT_H2T_MSG_TYPE_SET(local_word0, HTT_H2T_MSG_TYPE_TX_FRM); - HTT_TX_DESC_PKT_TYPE_SET(local_word0, pkt_type); - HTT_TX_DESC_PKT_SUBTYPE_SET(local_word0, pkt_subtype); - HTT_TX_DESC_VDEV_ID_SET(local_word0, msdu_info->info.vdev_id); - HTT_TX_DESC_EXT_TID_SET(local_word0, htt_get_ext_tid(type, - ext_header_data, msdu_info)); - HTT_TX_DESC_EXTENSION_SET(local_word0, desc_ext_required); - HTT_TX_DESC_EXT_TID_SET(local_word0, msdu_info->info.ext_tid); - HTT_TX_DESC_CKSUM_OFFLOAD_SET(local_word0, - msdu_info->action.cksum_offload); - if (pdev->cfg.is_high_latency) - HTT_TX_DESC_TX_COMP_SET(local_word0, msdu_info->action. - tx_comp_req); - HTT_TX_DESC_NO_ENCRYPT_SET(local_word0, - msdu_info->action.do_encrypt ? - 0 : 1); - } + + HTT_H2T_MSG_TYPE_SET(local_word0, HTT_H2T_MSG_TYPE_TX_FRM); + HTT_TX_DESC_PKT_TYPE_SET(local_word0, pkt_type); + HTT_TX_DESC_PKT_SUBTYPE_SET(local_word0, pkt_subtype); + HTT_TX_DESC_VDEV_ID_SET(local_word0, msdu_info->info.vdev_id); + HTT_TX_DESC_EXT_TID_SET(local_word0, htt_get_ext_tid(type, + ext_header_data, msdu_info)); + HTT_TX_DESC_EXTENSION_SET(local_word0, desc_ext_required); + HTT_TX_DESC_EXT_TID_SET(local_word0, msdu_info->info.ext_tid); + HTT_TX_DESC_CKSUM_OFFLOAD_SET(local_word0, + msdu_info->action.cksum_offload); + if (pdev->cfg.is_high_latency) + HTT_TX_DESC_TX_COMP_SET(local_word0, msdu_info->action. + tx_comp_req); + HTT_TX_DESC_NO_ENCRYPT_SET(local_word0, + msdu_info->action.do_encrypt ? + 0 : 1); *word0 = local_word0; |