diff options
| author | Po-Hao Huang <phhuang@realtek.com> | 2022-05-20 16:15:23 +0800 |
|---|---|---|
| committer | Kalle Valo <kvalo@kernel.org> | 2022-05-30 14:03:22 +0300 |
| commit | 32621eb61bfd003ffb586028d84bb6a2e84e3dac (patch) | |
| tree | 2d0755d4013c9842634ed18bf0f297ca084b522a | |
| parent | 425671f03b4e3fb62bcb588c50f776342d667371 (diff) | |
| download | linux-stable-32621eb61bfd003ffb586028d84bb6a2e84e3dac.tar.gz linux-stable-32621eb61bfd003ffb586028d84bb6a2e84e3dac.tar.bz2 linux-stable-32621eb61bfd003ffb586028d84bb6a2e84e3dac.zip | |
rtw88: fix null vif pointer when hw_scan fails
Add this check to avoid crash by dereferencing a null pointer. When hwscan
fails due to no memory or dma failure, the scan flag in ieee80211_local is
cleared. So mac80211 determine that it's not hw_scan then calls
sw_scan_complete() with null vif, which is also freed during the fail.
Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220520081523.45987-1-pkshih@realtek.com
| -rw-r--r-- | drivers/net/wireless/realtek/rtw88/main.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c index 14289f83feb5..d298cba23e3d 100644 --- a/drivers/net/wireless/realtek/rtw88/main.c +++ b/drivers/net/wireless/realtek/rtw88/main.c @@ -1383,9 +1383,12 @@ void rtw_core_scan_start(struct rtw_dev *rtwdev, struct rtw_vif *rtwvif, void rtw_core_scan_complete(struct rtw_dev *rtwdev, struct ieee80211_vif *vif, bool hw_scan) { - struct rtw_vif *rtwvif = (struct rtw_vif *)vif->drv_priv; + struct rtw_vif *rtwvif = vif ? (struct rtw_vif *)vif->drv_priv : NULL; u32 config = 0; + if (!rtwvif) + return; + clear_bit(RTW_FLAG_SCANNING, rtwdev->flags); clear_bit(RTW_FLAG_DIG_DISABLE, rtwdev->flags); |