diff options
| author | Avraham Stern <avraham.stern@intel.com> | 2018-12-24 10:59:13 +0200 |
|---|---|---|
| committer | Luca Coelho <luciano.coelho@intel.com> | 2019-02-14 11:29:46 +0200 |
| commit | cee859fe9ae33d0ed3edcc018ee4cc3081907d60 (patch) | |
| tree | d31dd48ad072eb3359719bf32405520305b22346 /drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | |
| parent | 4c816b2132aa287a1940125e7c33139710d9cf17 (diff) | |
| download | linux-cee859fe9ae33d0ed3edcc018ee4cc3081907d60.tar.gz linux-cee859fe9ae33d0ed3edcc018ee4cc3081907d60.tar.bz2 linux-cee859fe9ae33d0ed3edcc018ee4cc3081907d60.zip | |
iwlwifi: mvm: Fix possible NULL pointer dereference
iwl_mvm_te_clear_data() is called for cleanup in case sending
the HOT_SPOT_CMD failed. However, in case sending the command
caused a fw error and restart (e.g. if the command is not supported)
then the te_data pointer may no longer be valid, which leads to
a NULL pointer dereference.
Fix it by checking that the te_data pointer is not NULL before
dereferencing it.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi/mvm/time-event.c')
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c index 5b34100e9099..9693fa4cdc39 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c @@ -85,7 +85,7 @@ void iwl_mvm_te_clear_data(struct iwl_mvm *mvm, { lockdep_assert_held(&mvm->time_event_lock); - if (!te_data->vif) + if (!te_data || !te_data->vif) return; list_del(&te_data->list); |