P2P: Fix NULL pointer dereference with SD query cancellation
authorOla Olsson <ola.olsson@sonymobile.com>
Tue, 20 Jan 2015 09:45:52 +0000 (10:45 +0100)
committerJouni Malinen <j@w1.fi>
Thu, 22 Jan 2015 13:49:37 +0000 (15:49 +0200)
commitbff162ac76910bf772504bd9356fbb787b9c6d74
tree4c1709ff5dc42e2efb2d366dbfdae1192c523cfd
parent630b3230c86abf1976a39db596c51540e57e31c8
P2P: Fix NULL pointer dereference with SD query cancellation

A NULL pointer crash was caused by commit
7139cf4a4f1fecfd03d0daff9bb33adb80cc3530 ('P2P: Decrement
sd_pending_bcast_queries when sd returns'). p2p->sd_query can be cleared
to NULL whenever a query is cancelled, even in case the request had
already been transmitted. As such, need to be prepared for the query not
remaining when processing TX status callback for the frame.

Crashes on 2ee98 in following code
2ee90:       f7fc f8b6       bl      2b000 <p2p_dbg>
2ee94:       e02c            b.n     2eef0 <p2p_send_action_cb+0x348>
2ee96:       6c25            ldr     r5, [r4, #64]   ; 0x40
2ee98:       68ee            ldr     r6, [r5, #12]
2ee9a:       b166            cbz     r6, 2eeb6 <p2p_send_action_cb+0x30e>

Signed-off-by: Ola Olsson <ola.olsson@sonymobile.com>
src/p2p/p2p.c