Commit f5e8560e authored Mar 25, 2014 by Amitkumar Karwar Committed by John W. Linville Mar 27, 2014

mwifiex: corner case NULL pointer dereference fix



When next scan command is delayed due to Tx traffic and
meanwhile synchronous command is received followed by a signal,
we cance all pending commands. NULL pointer dereference is seen
in this case while queueing next command in scan delay timer.
This patch adds a check to fix this issue.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

parent 87b7e9e2

drivers/net/wireless/mwifiex/main.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -38,7 +38,8 @@ static void scan_delay_timer_fn(unsigned long data)
		if (adapter->surprise_removed)
		return;

		if (adapter->scan_delay_cnt == MWIFIEX_MAX_SCAN_DELAY_CNT) {
		if (adapter->scan_delay_cnt == MWIFIEX_MAX_SCAN_DELAY_CNT \|\|
		!adapter->scan_processing) {
		/*
		* Abort scan operation by cancelling all pending scan
		* commands