diff options
| author | Avraham Stern <avraham.stern@intel.com> | 2023-12-07 04:50:17 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2023-12-12 10:14:57 +0100 |
| commit | ce038edfce43fb345f8dfdca0f7b17f535896701 (patch) | |
| tree | 4056214613d521e21e8c99cb8db48d17d9995461 /drivers/net/wireless/intel/iwlwifi | |
| parent | 8c386b166e2517cf3a123018e77941ec22625d0f (diff) | |
| download | linux-ce038edfce43fb345f8dfdca0f7b17f535896701.tar.gz linux-ce038edfce43fb345f8dfdca0f7b17f535896701.tar.bz2 linux-ce038edfce43fb345f8dfdca0f7b17f535896701.zip | |
wifi: iwlwifi: pcie: avoid a NULL pointer dereference
It possible that while the rx rb is being handled, the transport has
been stopped and re-started. In this case the tx queue pointer is not
yet initialized, which will lead to a NULL pointer dereference.
Fix it.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20231207044813.cd0898cafd89.I0b84daae753ba9612092bf383f5c6f761446e964@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi')
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c index 146bc7bd14fb..bc6a9f861711 100644 --- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c @@ -1385,7 +1385,7 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans, * if it is true then one of the handlers took the page. */ - if (reclaim) { + if (reclaim && txq) { u16 sequence = le16_to_cpu(pkt->hdr.sequence); int index = SEQ_TO_INDEX(sequence); int cmd_index = iwl_txq_get_cmd_index(txq, index); |