Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d2d121bb authored by Anand Kumar's avatar Anand Kumar
Browse files

cnss: Initialize the unsafe channel list structure properly 



Initialize the unsafe channel list member properly to
avoid crash while accessing the uninitialized member.
As previously, member of unsafe channel list is not
initialized and it is leading to crash.
To avoid this situation, initialize the unsafe
channel list member properly.

Change-Id: I927475054117e37217dd9ce350f0b97de6e25e19
CRs-Fixed: 1026261
Signed-off-by: default avatarAnand Kumar <anandkumar@codeaurora.org>
parent 2ca3df6e

drivers/net/wireless/cnss/cnss_common.c

+5 −10
Original line number Diff line number Diff line
@@ -45,8 +45,6 @@ static struct cnss_dfs_nol_info { 


int cnss_set_wlan_unsafe_channel(u16 *unsafe_ch_list, u16 ch_count)

{

	struct cnss_unsafe_channel_list *unsafe_list;



	mutex_lock(&unsafe_channel_list_lock);

	if ((!unsafe_ch_list) || (ch_count > CNSS_MAX_CH_NUM)) {

		mutex_unlock(&unsafe_channel_list_lock);
@@ -57,7 +55,7 @@ int cnss_set_wlan_unsafe_channel(u16 *unsafe_ch_list, u16 ch_count) 


	if (ch_count != 0) {

		memcpy(

			(char *)unsafe_list->unsafe_ch_list,

			(char *)unsafe_channel_list.unsafe_ch_list,

			(char *)unsafe_ch_list, ch_count * sizeof(u16));

	}

	mutex_unlock(&unsafe_channel_list_lock);
@@ -70,25 +68,22 @@ int cnss_get_wlan_unsafe_channel( 
			u16 *unsafe_ch_list,

			u16 *ch_count, u16 buf_len)

{

	struct cnss_unsafe_channel_list *unsafe_list;



	mutex_lock(&unsafe_channel_list_lock);

	if (!unsafe_ch_list || !ch_count) {

		mutex_unlock(&unsafe_channel_list_lock);

		return -EINVAL;

	}



	unsafe_list = &unsafe_channel_list;

	if (buf_len < (unsafe_list->unsafe_ch_count * sizeof(u16))) {

	if (buf_len < (unsafe_channel_list.unsafe_ch_count * sizeof(u16))) {

		mutex_unlock(&unsafe_channel_list_lock);

		return -ENOMEM;

	}



	*ch_count = unsafe_list->unsafe_ch_count;

	*ch_count = unsafe_channel_list.unsafe_ch_count;

	memcpy(

		(char *)unsafe_ch_list,

		(char *)unsafe_list->unsafe_ch_list,

		unsafe_list->unsafe_ch_count * sizeof(u16));

		(char *)unsafe_channel_list.unsafe_ch_list,

		unsafe_channel_list.unsafe_ch_count * sizeof(u16));

	mutex_unlock(&unsafe_channel_list_lock);



	return 0;