diff options
| author | Victor Goldenshtein <victorg@ti.com> | 2013-09-17 15:41:25 (GMT) |
|---|---|---|
| committer | Luciano Coelho <luciano.coelho@intel.com> | 2013-09-30 18:12:20 (GMT) |
| commit | bf9d5d28aabc6e420a0b6fb3a24b93046878e864 (patch) | |
| tree | b10200f4e0e73794b9b1a3bf4b195ffba26ba495 /drivers/net/wireless | |
| parent | 0fe72086afcb3fa685ff8bfa8c975d826b245f25 (diff) | |
| download | linux-fsl-qoriq-bf9d5d28aabc6e420a0b6fb3a24b93046878e864.tar.xz | |
wlcore: fix unsafe dereference of the wlvif
wlvif could be passed as NULL from the wlcore_tx_work_locked()
to the wl1271_prepare_tx_frame() and to wl1271_skb_queue_head()
functions. This may lead to a Kernel panic, fix this by
validating that wlvif != NULL.
Signed-off-by: Victor Goldenshtein <victorg@ti.com>
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Diffstat (limited to 'drivers/net/wireless')
| -rw-r--r-- | drivers/net/wireless/ti/wlcore/tx.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/ti/wlcore/tx.c b/drivers/net/wireless/ti/wlcore/tx.c index 03249da..87cd707 100644 --- a/drivers/net/wireless/ti/wlcore/tx.c +++ b/drivers/net/wireless/ti/wlcore/tx.c @@ -401,7 +401,7 @@ static int wl1271_prepare_tx_frame(struct wl1271 *wl, struct wl12xx_vif *wlvif, is_wep = (cipher == WLAN_CIPHER_SUITE_WEP40) || (cipher == WLAN_CIPHER_SUITE_WEP104); - if (WARN_ON(is_wep && wlvif->default_key != idx)) { + if (WARN_ON(is_wep && wlvif && wlvif->default_key != idx)) { ret = wl1271_set_default_wep_key(wl, wlvif, idx); if (ret < 0) return ret; |