diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2012-09-20 16:06:14 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2012-09-20 16:37:40 +0200 |
| commit | 513aa3b0d14be809490d5c151994cc7f047b0718 (patch) | |
| tree | 07c64064f1bed5480c7ddd26369d22c29a8fd915 /drivers/net/wireless/iwlwifi/dvm | |
| parent | ca42613a55aa947704a40945597c6f9b856df437 (diff) | |
iwlwifi: fix async station command crash
Before Emmanuel's change to use a copy of the command
("iwlwifi: get the correct HCMD in the response handler")
the iwl_add_sta_callback() function would have used a
random pointer to somewhere when processing responses
to an async command, while that wasn't valid data it
was at least a valid pointer. Now, the pointer will be
NULL in this case, thus crashing.
Fix this by exiting the function early if no command
is passed back which means it was sent asynchronously.
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'drivers/net/wireless/iwlwifi/dvm')
| -rw-r--r-- | drivers/net/wireless/iwlwifi/dvm/sta.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c index fe36a38f350..cd9b6de4273 100644 --- a/drivers/net/wireless/iwlwifi/dvm/sta.c +++ b/drivers/net/wireless/iwlwifi/dvm/sta.c @@ -128,10 +128,11 @@ int iwl_add_sta_callback(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb, struct iwl_device_cmd *cmd) { struct iwl_rx_packet *pkt = rxb_addr(rxb); - struct iwl_addsta_cmd *addsta = - (struct iwl_addsta_cmd *) cmd->payload; - return iwl_process_add_sta_resp(priv, addsta, pkt); + if (!cmd) + return 0; + + return iwl_process_add_sta_resp(priv, (void *)cmd->payload, pkt); } int iwl_send_add_sta(struct iwl_priv *priv, |