diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2015-06-26 16:04:01 +0200 |
|---|---|---|
| committer | Emmanuel Grumbach <emmanuel.grumbach@intel.com> | 2015-07-12 19:54:17 +0300 |
| commit | 00fd233ac491708d1f64b7176be73c84a18a54a2 (patch) | |
| tree | defcedaa33e3312e51b385050b3501af758eb629 | |
| parent | f9e5554cd8ca1d1212ec922755b397a20f737923 (diff) | |
| download | linux-stable-00fd233ac491708d1f64b7176be73c84a18a54a2.tar.gz linux-stable-00fd233ac491708d1f64b7176be73c84a18a54a2.tar.bz2 linux-stable-00fd233ac491708d1f64b7176be73c84a18a54a2.zip | |
iwlwifi: mvm: check time-event vif to avoid bad deletion
The time event is initialized relatively late in interface (mvmvif)
initialization, so it's possible to fail before that happens. As a
consequence, the driver will crash if it ever tries to delete this
time event in case initialization was unsuccessful.
Avoid this by using the time event's vif pointer to indicate validity.
The vif pointer is != NULL whenever the id is != TE_MAX, except for
this special error case where the vif pointer will have the correct
property (as the whole memory is cleared on allocation) whereas the
id is 0, causing a crash in trying to delete the time event from the
list.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
| -rw-r--r-- | drivers/net/wireless/iwlwifi/mvm/time-event.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c index d24b6a83e68c..e472729e5f14 100644 --- a/drivers/net/wireless/iwlwifi/mvm/time-event.c +++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c @@ -86,7 +86,7 @@ void iwl_mvm_te_clear_data(struct iwl_mvm *mvm, { lockdep_assert_held(&mvm->time_event_lock); - if (te_data->id == TE_MAX) + if (!te_data->vif) return; list_del(&te_data->list); |