diff options
| author |   Amitkumar Karwar <akarwar@marvell.com> | 2014-03-25 19:01:18 -0700 |
|---|---|---|
| committer |   John W. Linville <linville@tuxdriver.com> | 2014-03-27 14:20:06 -0400 |
| commit | f5e8560ee0f10e7daf4bc16caf7c50bb30fced9c (patch) | |
| tree | 441ae72e75e2b5b28b517692b58f0743b80d21db /drivers/net/wireless | |
| parent | brcmfmac: use mfp if required from user-space (diff) | |
| download | linux-dev-f5e8560ee0f10e7daf4bc16caf7c50bb30fced9c.tar.xz linux-dev-f5e8560ee0f10e7daf4bc16caf7c50bb30fced9c.zip | |
mwifiex: corner case NULL pointer dereference fix
When next scan command is delayed due to Tx traffic and
meanwhile synchronous command is received followed by a signal,
we cance all pending commands. NULL pointer dereference is seen
in this case while queueing next command in scan delay timer.
This patch adds a check to fix this issue.
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless')
| -rw-r--r-- | drivers/net/wireless/mwifiex/main.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c index 5397ee0ad652..668a91cd1154 100644 --- a/drivers/net/wireless/mwifiex/main.c +++ b/drivers/net/wireless/mwifiex/main.c @@ -38,7 +38,8 @@ static void scan_delay_timer_fn(unsigned long data) if (adapter->surprise_removed) return; - if (adapter->scan_delay_cnt == MWIFIEX_MAX_SCAN_DELAY_CNT) { + if (adapter->scan_delay_cnt == MWIFIEX_MAX_SCAN_DELAY_CNT || + !adapter->scan_processing) { /* * Abort scan operation by cancelling all pending scan * commands |