Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 86a9c4a2 authored by Antonio Quartulli's avatar Antonio Quartulli Committed by John W. Linville
Browse files

brcm80211: fix null pointer access 



Do not unconditionally access the chan variable in
brcmf_cfg80211_mgmt_tx() as it may be NULL.
Use freq instead.

Introduced by c2ff8cad
("brcm80211: make mgmt_tx in brcmfmac accept a NULL channel")

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarAntonio Quartulli <antonio@open-mesh.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent f2bbb077

drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c

+1 −2
Original line number Diff line number Diff line
@@ -4050,8 +4050,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, 
		       le16_to_cpu(action_frame->len));



		brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",

			  *cookie, le16_to_cpu(action_frame->len),

			  chan->center_freq);

			  *cookie, le16_to_cpu(action_frame->len), freq);



		ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),

						  af_params);