Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bf9d5d28 authored by Victor Goldenshtein's avatar Victor Goldenshtein Committed by Luciano Coelho
Browse files

wlcore: fix unsafe dereference of the wlvif 



wlvif could be passed as NULL from the wlcore_tx_work_locked()
to the wl1271_prepare_tx_frame() and to wl1271_skb_queue_head()
functions. This may lead to a Kernel panic, fix this by
validating that wlvif != NULL.

Signed-off-by: default avatarVictor Goldenshtein <victorg@ti.com>
Signed-off-by: default avatarEliad Peller <eliad@wizery.com>
Signed-off-by: default avatarLuciano Coelho <luciano.coelho@intel.com>
parent 0fe72086

drivers/net/wireless/ti/wlcore/tx.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -401,7 +401,7 @@ static int wl1271_prepare_tx_frame(struct wl1271 *wl, struct wl12xx_vif *wlvif, 
		is_wep = (cipher == WLAN_CIPHER_SUITE_WEP40) ||

		is_wep = (cipher == WLAN_CIPHER_SUITE_WEP40) ||

			 (cipher == WLAN_CIPHER_SUITE_WEP104);

			 (cipher == WLAN_CIPHER_SUITE_WEP104);





		if (WARN_ON(is_wep && wlvif->default_key != idx)) {

		if (WARN_ON(is_wep && wlvif && wlvif->default_key != idx)) {

			ret = wl1271_set_default_wep_key(wl, wlvif, idx);

			ret = wl1271_set_default_wep_key(wl, wlvif, idx);

			if (ret < 0)

			if (ret < 0)

				return ret;

				return ret;