diff options
| author | Lorenzo Bianconi <lorenzo@kernel.org> | 2020-12-08 12:18:11 +0300 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2020-12-20 15:04:59 +0300 |
| commit | f7217f718747641fc80cd062f183107439f2a066 (patch) | |
| tree | ff3c524fbaf75b094eb5cc0a7535ed162ebd5dd4 /drivers/net/wireless/mediatek | |
| parent | 123bb2b737881127b450e8b3b1bae69a8949498e (diff) | |
| download | linux-f7217f718747641fc80cd062f183107439f2a066.tar.xz | |
mt76: mt76s: fix NULL pointer dereference in mt76s_process_tx_queue
Fix a possible NULL pointer dereference in mt76s_process_tx_queue that
can occur if status thread runs before allocating tx queues
Fixes: 6a618acb7e62 ("mt76: sdio: convert {status/net}_work to mt76_worker")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/b49c1b4edacd87b2241a9fd0431dd4864c8963f6.1607418933.git.lorenzo@kernel.org
Diffstat (limited to 'drivers/net/wireless/mediatek')
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/sdio.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c index 7cd995118257..0b6facb17ff7 100644 --- a/drivers/net/wireless/mediatek/mt76/sdio.c +++ b/drivers/net/wireless/mediatek/mt76/sdio.c @@ -157,10 +157,14 @@ static void mt76s_net_worker(struct mt76_worker *w) static int mt76s_process_tx_queue(struct mt76_dev *dev, struct mt76_queue *q) { - bool mcu = q == dev->q_mcu[MT_MCUQ_WM]; struct mt76_queue_entry entry; int nframes = 0; + bool mcu; + if (!q) + return 0; + + mcu = q == dev->q_mcu[MT_MCUQ_WM]; while (q->queued > 0) { if (!q->entry[q->tail].done) break; |