summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: b6ee0d2)
raw | patch | inline | side by side (parent: b6ee0d2)
wl12xx: fix unsafe dereference of the wlvif R5.xx_Build-263 R5.xx_Build-264 R5.xx_Build-265 R5.xx_Build-266 R5.xx_Build-267 R5.xx_Build-268 R5.xx_Build-269 R5.xx_Build-270 R5.xx_Build-271 R5.xx_Build-272 R5.xx_Build-273 R5.xx_Build-274 R5.xx_Build-275 R5.xx_Build-276 R5.xx_Build-277 R5.xx_Build-278 R5.xx_Build-279 R5.xx_Build-280 R5.xx_Build-281 R5.xx_Build-282 R5.xx_Build-283 R5.xx_Build-284 R5.xx_Build-285 R5.xx_Build-286 R5.xx_Build-287 R5.xx_Build-288 ol_R5.SP6.01
author | Victor Goldenshtein <victorg@ti.com> | |
Thu, 17 Jan 2013 12:15:24 +0000 (14:15 +0200) | ||
committer | Victor Goldenshtein <victorg@ti.com> | |
Tue, 19 Mar 2013 13:38:39 +0000 (15:38 +0200) |
wlvif could be passed as NULL from the wl1271_tx_work_locked()
to the wl1271_prepare_tx_frame() and to wl1271_skb_queue_head()
functions. This may lead to a Kernel panic, fix this by
validating that wlvif != NULL before using it.
Signed-off-by: Victor Goldenshtein <victorg@ti.com>
to the wl1271_prepare_tx_frame() and to wl1271_skb_queue_head()
functions. This may lead to a Kernel panic, fix this by
validating that wlvif != NULL before using it.
Signed-off-by: Victor Goldenshtein <victorg@ti.com>
drivers/net/wireless/wl12xx/tx.c | patch | blob | history |
index be05919907d1bbd7afc4119c9b5d7cbe8b3bdd11..f9283e3a193c8a168fe8a38ff56f8f0b640e3004 100644 (file)
is_wep = (cipher == WLAN_CIPHER_SUITE_WEP40) ||
(cipher == WLAN_CIPHER_SUITE_WEP104);
- if (unlikely(is_wep && wlvif->default_key != idx)) {
+ if (unlikely(is_wep && wlvif && wlvif->default_key != idx)) {
WARN_ON(1);
ret = wl1271_set_default_wep_key(wl, wlvif, idx);
if (ret < 0)
skb_queue_head(&wl->links[hlid].tx_queue[q], skb);
/* make sure we dequeue the same packet next time */
- wlvif->last_tx_hlid = (hlid + WL12XX_MAX_LINKS - 1) %
- WL12XX_MAX_LINKS;
+ if (wlvif)
+ wlvif->last_tx_hlid = (hlid + WL12XX_MAX_LINKS - 1) %
+ WL12XX_MAX_LINKS;
}
spin_lock_irqsave(&wl->wl_lock, flags);