diff options
| author |   Samuel Ortiz <sameo@linux.intel.com> | 2009-10-16 13:18:55 +0800 |
|---|---|---|
| committer |   John W. Linville <linville@tuxdriver.com> | 2009-10-27 16:48:26 -0400 |
| commit | 708567e0723f3a217286c2b60805af6de360ec50 (patch) | |
| tree | 7ae30ebce5cf1fcdee80ce985ad1272ef3e82342 /drivers/net/wireless/iwmc3200wifi | |
| parent | iwmc3200wifi: SDIO disable race fix (diff) | |
| download | linux-dev-708567e0723f3a217286c2b60805af6de360ec50.tar.xz linux-dev-708567e0723f3a217286c2b60805af6de360ec50.zip | |
iwmc3200wifi: Check for cmd pointer before dereferencing it
The wifi_if_wrapper notification handling code uses a cmd pointer without
checking if it's valid or not. We're dereferencing it because we assume that
we only get to that point if there was a pending command for us. That's not
always true, so we'd better check.
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/iwmc3200wifi')
| -rw-r--r-- | drivers/net/wireless/iwmc3200wifi/rx.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c index 225b1d3b2735..648f84a83705 100644 --- a/drivers/net/wireless/iwmc3200wifi/rx.c +++ b/drivers/net/wireless/iwmc3200wifi/rx.c @@ -1057,8 +1057,14 @@ static int iwm_ntf_wifi_if_wrapper(struct iwm_priv *iwm, u8 *buf, unsigned long buf_size, struct iwm_wifi_cmd *cmd) { - struct iwm_umac_wifi_if *hdr = - (struct iwm_umac_wifi_if *)cmd->buf.payload; + struct iwm_umac_wifi_if *hdr; + + if (cmd == NULL) { + IWM_ERR(iwm, "Couldn't find expected wifi command\n"); + return -EINVAL; + } + + hdr = (struct iwm_umac_wifi_if *)cmd->buf.payload; IWM_DBG_NTF(iwm, DBG, "WIFI_IF_WRAPPER cmd is delivered to UMAC: " "oid is 0x%x\n", hdr->oid); |