From fd07e6fe9cca701df9cdec8acddff8d11dacae7f Mon Sep 17 00:00:00 2001 From: Sandeep Puligilla Date: Wed, 2 Nov 2016 18:28:34 -0700 Subject: qcacld-3.0: Fix null pointer dereference During roaming join request pointer in the session is not initilized and the same pointer gets dereferenced as part of the heart beat timeout handler. Add validation check before accessing the join request holder in the session. Change-Id: I92a4f13a611b9e8eb11dac1194e52ddd726dbc41 CRs-Fixed: 1084701 --- core/mac/src/pe/lim/lim_link_monitoring_algo.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/core/mac/src/pe/lim/lim_link_monitoring_algo.c b/core/mac/src/pe/lim/lim_link_monitoring_algo.c index 57f00e48abd3..4f678f3d5c45 100644 --- a/core/mac/src/pe/lim/lim_link_monitoring_algo.c +++ b/core/mac/src/pe/lim/lim_link_monitoring_algo.c @@ -434,6 +434,7 @@ void lim_handle_heart_beat_failure(tpAniSirGlobal mac_ctx, tpPESession session) { uint8_t curr_chan; + tpSirAddie scan_ie = NULL; #ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM /* FEATURE_WLAN_DIAG_SUPPORT */ host_log_beacon_update_pkt_type *log_ptr = NULL; @@ -489,11 +490,21 @@ void lim_handle_heart_beat_failure(tpAniSirGlobal mac_ctx, lim_log(mac_ctx, LOGW, FL("HB missed from AP. Sending Probe Req")); /* for searching AP, we don't include any more IE */ - lim_send_probe_req_mgmt_frame(mac_ctx, &session->ssId, - session->bssId, curr_chan, session->selfMacAddr, - session->dot11mode, - session->pLimJoinReq->addIEScan.length, - session->pLimJoinReq->addIEScan.addIEdata); + if (session->pLimJoinReq != NULL) { + scan_ie = &session->pLimJoinReq->addIEScan; + lim_send_probe_req_mgmt_frame(mac_ctx, + &session->ssId, + session->bssId, curr_chan, + session->selfMacAddr, + session->dot11mode, + scan_ie->length, scan_ie->addIEdata); + } else { + lim_send_probe_req_mgmt_frame(mac_ctx, + &session->ssId, + session->bssId, curr_chan, + session->selfMacAddr, + session->dot11mode, 0, NULL); + } } else { lim_log(mac_ctx, LOGW, FL("HB missed from AP on DFS chanel moving to passive")); -- cgit v1.2.3