From d79c4e6cfa11dc0e5f93317ec70a5f587dca29da Mon Sep 17 00:00:00 2001 From: Manishekar Chandrasekaran Date: Thu, 23 Jun 2016 08:36:49 +0530 Subject: qcacld-3.0: Sanitize SAP context before extracting the handle Ensure that the SAP context is sanitized before extracting the global handle. The context passed in the callback could be freed by the time it is accessed. Change-Id: I4a08717abce2a0ecbe4055360fd8d31c3e50a701 CRs-Fixed: 1031855 --- core/sap/src/sap_api_link_cntl.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/core/sap/src/sap_api_link_cntl.c b/core/sap/src/sap_api_link_cntl.c index 43ccbf2edb4a..d0b3a00582c0 100644 --- a/core/sap/src/sap_api_link_cntl.c +++ b/core/sap/src/sap_api_link_cntl.c @@ -808,25 +808,26 @@ wlansap_roam_callback(void *ctx, tCsrRoamInfo *csr_roam_info, uint32_t roamId, eRoamCmdStatus roam_status, eCsrRoamResult roam_result) { /* sap_ctx value */ - ptSapContext sap_ctx = (ptSapContext) ctx; + ptSapContext sap_ctx; /* State machine event */ tWLAN_SAPEvent sap_event; QDF_STATUS qdf_status = QDF_STATUS_SUCCESS; QDF_STATUS qdf_ret_status = QDF_STATUS_SUCCESS; - tHalHandle hal = CDS_GET_HAL_CB(sap_ctx->p_cds_gctx); + tHalHandle hal; tpAniSirGlobal mac_ctx = NULL; uint8_t intf; - if (NULL == hal) { + if (QDF_IS_STATUS_ERROR(wlansap_context_get((ptSapContext)ctx))) + return QDF_STATUS_E_FAILURE; + + sap_ctx = (ptSapContext) ctx; + hal = CDS_GET_HAL_CB(sap_ctx->p_cds_gctx); + if (!hal) { QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_ERROR, - FL("Invalid hal")); - qdf_ret_status = QDF_STATUS_E_NOMEM; - return qdf_ret_status; + FL("Invalid handle")); + return QDF_STATUS_E_NOMEM; } - if (QDF_IS_STATUS_ERROR(wlansap_context_get(sap_ctx))) - return QDF_STATUS_E_FAILURE; - mac_ctx = PMAC_STRUCT(hal); QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_INFO_HIGH, FL("Before switch on roam_status = %d\n"), roam_status); -- cgit v1.2.3