commit 3baca6cc248e0d9a852c25b214c92bc856ae03ea
author Dmitry Shmidt <dimitrysh@google.com> Tue Mar 23 13:03:34 2010 -0700
committer Dmitry Shmidt <dimitrysh@google.com> Tue Mar 23 13:03:34 2010 -0700
tree 08639d30eab9327785450f98dd5b3e63fbb50262
parent ebbf3c4d16536e401fdaf0389d592590c4bae83d

tnetw1271: Fix NULL pointer exception in Timer functions

Change-Id: I4108dd500304ad708b2244f9e1aa845f3f217221
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

wilink_6_1/utils/timer.c

diff --git a/wilink_6_1/utils/timer.c b/wilink_6_1/utils/timer.c
index 0fbd726..e1795f0 100644
--- a/wilink_6_1/utils/timer.c
+++ b/wilink_6_1/utils/timer.c
@@ -125,19 +125,27 @@
 {
     TTimerModule *pTimerModule = (TTimerModule *)hTimerModule;
 
+    if (!pTimerModule)
+    {
+        WLAN_OS_REPORT (("tmr_Destroy(): ERROR - NULL timer!\n"));
+        return TI_NOK;
+    }
+
     /* Alert if there are still timers that were not destroyed */
     if (pTimerModule->uTimersCount)
     {
         WLAN_OS_REPORT (("tmr_Destroy():  ERROR - Destroying Timer module but not all timers were destroyed!!\n"));
     }
-
-    /* Clear queues */
+#if 0
+    /* Clear queues (critical section is used inside these functions) */
     tmr_ClearInitQueue (hTimerModule);
     tmr_ClearOperQueue (hTimerModule);
-
-    /* Destroy the module's queues */
+#endif
+    /* Destroy the module's queues (protect in critical section)) */
+    context_EnterCriticalSection (pTimerModule->hContext);
     que_Destroy (pTimerModule->hInitQueue);
     que_Destroy (pTimerModule->hOperQueue);
+    context_LeaveCriticalSection (pTimerModule->hContext);
 
     /* free module object */
     os_memoryFree (pTimerModule->hOs, pTimerModule, sizeof(TTimerModule));
@@ -158,6 +166,12 @@
 {
     TTimerModule *pTimerModule = (TTimerModule *)hTimerModule;
 
+    if (!pTimerModule)
+    {
+        WLAN_OS_REPORT (("tmr_Free(): ERROR - NULL timer!\n"));
+        return TI_NOK;
+    }
+
     /* free module object */
     os_memoryFree (pTimerModule->hOs, pTimerModule, sizeof(TTimerModule));
 	
@@ -221,6 +235,12 @@
     TTimerModule *pTimerModule = (TTimerModule *)hTimerModule;
     TI_UINT32     uNodeHeaderOffset;
 
+    if (!pTimerModule)
+    {
+        WLAN_OS_REPORT (("tmr_Init(): ERROR - NULL timer!\n"));
+        return;
+    }
+
     pTimerModule->hOs           = hOs;
     pTimerModule->hReport       = hReport;
     pTimerModule->hContext      = hContext;
@@ -272,6 +292,12 @@
     TTimerModule *pTimerModule = (TTimerModule *)hTimerModule;
     TTimerInfo   *pTimerInfo;      /* The timer handle */
 
+    if (!pTimerModule)
+    {
+        WLAN_OS_REPORT (("tmr_UpdateDriverState(): ERROR - NULL timer!\n"));
+        return;
+    }
+
     /* Enter critical section */
     context_EnterCriticalSection (pTimerModule->hContext);
 
@@ -331,6 +357,12 @@
     TTimerModule *pTimerModule = (TTimerModule *)hTimerModule; /* The timer module handle */
     TTimerInfo   *pTimerInfo;  /* The created timer handle */
 
+    if (!pTimerModule)
+    {
+        WLAN_OS_REPORT (("tmr_CreateTimer(): ERROR - NULL timer!\n"));
+        return NULL;
+    }
+
     /* Allocate timer object */
     pTimerInfo = os_memoryAlloc (pTimerModule->hOs, sizeof(TTimerInfo));
     if (!pTimerInfo)
@@ -376,8 +408,16 @@
     TTimerModule *pTimerModule;                  /* The timer module handle */
 
     if (!pTimerInfo)
+    {
         return TI_NOK;
+    }
     pTimerModule = (TTimerModule *)pTimerInfo->hTimerModule;
+    if (!pTimerModule)
+    {
+        WLAN_OS_REPORT (("tmr_DestroyTimer(): ERROR - NULL timer!\n"));
+        return TI_NOK;
+    }
+
     /* Free the OS-API timer */
     if (pTimerInfo->hOsTimerObj) {
         os_timerDestroy (pTimerModule->hOs, pTimerInfo->hOsTimerObj);
@@ -418,6 +458,12 @@
     TTimerInfo   *pTimerInfo   = (TTimerInfo *)hTimerInfo;                 /* The timer handle */     
     TTimerModule *pTimerModule = (TTimerModule *)pTimerInfo->hTimerModule; /* The timer module handle */
 
+    if (!pTimerModule)
+    {
+        WLAN_OS_REPORT (("tmr_StartTimer(): ERROR - NULL timer!\n"));
+        return;
+    }
+
     /* Save the timer parameters. */
     pTimerInfo->fExpiryCbFunc            = fExpiryCbFunc;
     pTimerInfo->hExpiryCbHndl            = hExpiryCbHndl;
@@ -449,6 +495,12 @@
     TTimerInfo   *pTimerInfo   = (TTimerInfo *)hTimerInfo;                 /* The timer handle */     
     TTimerModule *pTimerModule = (TTimerModule *)pTimerInfo->hTimerModule; /* The timer module handle */
 
+    if (!pTimerModule)
+    {
+        WLAN_OS_REPORT (("tmr_StopTimer(): ERROR - NULL timer!\n"));
+        return;
+    }
+
     /* Stop OS-API timer running */
     os_timerStop(pTimerModule->hOs, pTimerInfo->hOsTimerObj);
 
@@ -473,7 +525,13 @@
 void tmr_GetExpiry (TI_HANDLE hTimerInfo)
 {
     TTimerInfo   *pTimerInfo   = (TTimerInfo *)hTimerInfo;                 /* The timer handle */     
-	TTimerModule *pTimerModule = (TTimerModule *)pTimerInfo->hTimerModule; /* The timer module handle */
+    TTimerModule *pTimerModule = (TTimerModule *)pTimerInfo->hTimerModule; /* The timer module handle */
+
+    if (!pTimerModule)
+    {
+        WLAN_OS_REPORT (("tmr_GetExpiry(): ERROR - NULL timer!\n"));
+        return;
+    }
 
     /* Enter critical section */
     context_EnterCriticalSection (pTimerModule->hContext);
@@ -525,6 +583,12 @@
     TTimerInfo   *pTimerInfo;      /* The timer handle */     
     TI_BOOL       bTwdInitOccured; /* Indicates if TWD init occured since timer start */
 
+    if (!pTimerModule)
+    {
+        WLAN_OS_REPORT (("tmr_HandleExpiry(): ERROR - NULL timer!\n"));
+        return;
+    }
+
     while (1)
     {
         /* Enter critical section */
@@ -588,6 +652,12 @@
 {
     TTimerModule *pTimerModule = (TTimerModule *)hTimerModule;
 
+    if (!pTimerModule)
+    {
+        WLAN_OS_REPORT (("tmr_PrintModule(): ERROR - NULL timer!\n"));
+        return;
+    }
+
     /* Print module parameters */
     WLAN_OS_REPORT(("tmr_PrintModule(): uContextId=%d, bOperState=%d, uTwdInitCount=%d, uTimersCount=%d\n", 
     pTimerModule->uContextId, pTimerModule->bOperState,