Piteball/android_kernel_samsung_msm8976
1
1
Fork 0
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git synced 2024-11-01 02:21:16 +00:00
Code Issues Projects Releases Wiki Activity

qcacld-2.0: Validate pHashTable

Browse source 
prima to qcacld-2.0 propagation

When deauth/disassoc is received from peer at the same time when
cleanup in progress because of disconnect from supplicant, there
is a chance that pHashTable can be NULL. Memory pointed by
pHashTable is freed during peDeleteSession, which is called during
cleanup. In dphLookupHashEntry, pHashTable is referenced without
any NULL check, which can lead to crash. Fix this by validating
pHashTable for NULL check.

Add a NULL check in _limProcessOperatingModeActionFrame before
referencing sta context to resolve potential KW issue.

Change-Id: I74d5c739cade19941320ee02eddc09e4fc74b105
CRs-Fixed: 898375
This commit is contained in:
Padma, Santhosh Kumar 2015-11-03 19:41:27 +05:30 committed by syphyr
parent a9bfe7022d
commit 2ebfca5060
2 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
drivers/net/wireless/qcacld-2.0/CORE/MAC/src/dph/dphHashTable.c
View file

@ -134,6 +134,11 @@ tpDphHashNode dphLookupHashEntry(tpAniSirGlobal pMac, tANI_U8 staAddr[], tANI_U1
tpDphHashNode ptr = NULL;
tANI_U16 index = hashFunction(pMac, staAddr, pDphHashTable->size);
if (!pDphHashTable->pHashTable) {
limLog(pMac, LOGE, FL(" pHashTable is NULL "));
return ptr;
}
for (ptr = pDphHashTable->pHashTable[index]; ptr; ptr = ptr->next)
{
if (dphCompareMacAddr(staAddr, ptr->staAddr))

4
drivers/net/wireless/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessActionFrame.c
View file

@ -562,8 +562,10 @@ __limProcessOperatingModeActionFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo
}
pSta = dphLookupHashEntry(pMac, pHdr->sa, &aid, &psessionEntry->dph.dphHashTable);
if (pSta == NULL)
if (pSta == NULL) {
limLog(pMac, LOGE, FL("Station context not found"));
goto end;
}
operMode = pSta->vhtSupportedChannelWidthSet ? eHT_CHANNEL_WIDTH_80MHZ : pSta->htSupportedChannelWidthSet ? eHT_CHANNEL_WIDTH_40MHZ: eHT_CHANNEL_WIDTH_20MHZ;