diff mbox series

rtw88: fix null vif pointer when hw_scan fails

Message ID 20220520081523.45987-1-pkshih@realtek.com (mailing list archive)
State Accepted
Commit 32621eb61bfd003ffb586028d84bb6a2e84e3dac
Delegated to: Kalle Valo
Headers show
Series rtw88: fix null vif pointer when hw_scan fails | expand

Commit Message

Ping-Ke Shih May 20, 2022, 8:15 a.m. UTC 
From: Po-Hao Huang <phhuang@realtek.com>

Add this check to avoid crash by dereferencing a null pointer. When hwscan
fails due to no memory or dma failure, the scan flag in ieee80211_local is
cleared. So mac80211 determine that it's not hw_scan then calls
sw_scan_complete() with null vif, which is also freed during the fail.

Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw88/main.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Comments

Kalle Valo May 30, 2022, 11:03 a.m. UTC | #1 
Ping-Ke Shih <pkshih@realtek.com> wrote:

> From: Po-Hao Huang <phhuang@realtek.com>
> 
> Add this check to avoid crash by dereferencing a null pointer. When hwscan
> fails due to no memory or dma failure, the scan flag in ieee80211_local is
> cleared. So mac80211 determine that it's not hw_scan then calls
> sw_scan_complete() with null vif, which is also freed during the fail.
> 
> Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>

Patch applied to wireless-next.git, thanks.

32621eb61bfd rtw88: fix null vif pointer when hw_scan fails
diff mbox series

Patch

diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
index 14289f83feb54..d298cba23e3d3 100644
--- a/drivers/net/wireless/realtek/rtw88/main.c
+++ b/drivers/net/wireless/realtek/rtw88/main.c
@@ -1383,9 +1383,12 @@  void rtw_core_scan_start(struct rtw_dev *rtwdev, struct rtw_vif *rtwvif,
 void rtw_core_scan_complete(struct rtw_dev *rtwdev, struct ieee80211_vif *vif,
 			    bool hw_scan)
 {
-	struct rtw_vif *rtwvif = (struct rtw_vif *)vif->drv_priv;
+	struct rtw_vif *rtwvif = vif ? (struct rtw_vif *)vif->drv_priv : NULL;
 	u32 config = 0;
 
+	if (!rtwvif)
+		return;
+
 	clear_bit(RTW_FLAG_SCANNING, rtwdev->flags);
 	clear_bit(RTW_FLAG_DIG_DISABLE, rtwdev->flags);