Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d122b0fd authored by Dundi Raviteja's avatar Dundi Raviteja
Browse files

wlan: Validate pkt_stats_buffers before dereferencing 

For wlan logging, number of pkt_stats_buffers are stored
in pkt_stat_num_buf. If skb allocation failed pkt_stats_buffers
is freed but pkt_stat_num_buf is not set zero. This causes
NULL pointer dereference while deactivating wlan logging.

To avoid this set pkt_stat_num_buf to zero if skb allocation fails
and validate pkt_stats_buffers before de-referencing.

Change-Id: I54f8167e21fb71662c94988f9cd8033363611e16
CRs-Fixed: 2708247
parent e67de3a6

CORE/SVC/src/logging/wlan_logging_sock_svc.c

+2 −1
Original line number Diff line number Diff line
@@ -1537,6 +1537,7 @@ int wlan_logging_sock_activate_svc(int log_fe_to_console, int num_buf, 
					dev_kfree_skb(pkt_stats_buffers[j].skb);

				}

			spin_lock_irqsave(&gwlan_logging.spin_lock, irq_flag);

			gwlan_logging.pkt_stat_num_buf = 0;

			vos_mem_free(pkt_stats_buffers);

			pkt_stats_buffers = NULL;

			spin_unlock_irqrestore(&gwlan_logging.spin_lock, irq_flag);
@@ -1665,7 +1666,7 @@ int wlan_logging_sock_deactivate_svc(void) 
	/* free allocated skb */

	for (i = 0; i < gwlan_logging.pkt_stat_num_buf; i++)

	{

		if (pkt_stats_buffers[i].skb)

		if (pkt_stats_buffers && pkt_stats_buffers[i].skb)

			dev_kfree_skb(pkt_stats_buffers[i].skb);

	}

	if(pkt_stats_buffers)