Mac80211 can transmit packets where the control.sta field is NULL. The driver dereferenced this. Bugfix was to only dereference a non NULL ieee80211_sta pointer.
Signed-off-by: Roland Vossen <[email protected]> Reviewed-by: Arend van Spriel <[email protected]> --- drivers/staging/brcm80211/brcmsmac/wlc_main.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/drivers/staging/brcm80211/brcmsmac/wlc_main.c b/drivers/staging/brcm80211/brcmsmac/wlc_main.c index bd0e3ec..cc16504 100644 --- a/drivers/staging/brcm80211/brcmsmac/wlc_main.c +++ b/drivers/staging/brcm80211/brcmsmac/wlc_main.c @@ -6612,7 +6612,8 @@ wlc_dotxstatus(struct wlc_info *wlc, tx_status_t *txs, u32 frm_tx2) tx_info = IEEE80211_SKB_CB(p); h = (struct ieee80211_hdr *)((u8 *) (txh + 1) + D11_PHY_HDR_LEN); - scb = (struct scb *)tx_info->control.sta->drv_priv; + if (tx_info->control.sta) + scb = (struct scb *)tx_info->control.sta->drv_priv; if (N_ENAB(wlc->pub)) { u8 *plcp = (u8 *) (txh + 1); -- 1.7.1 _______________________________________________ devel mailing list [email protected] http://driverdev.linuxdriverproject.org/mailman/listinfo/devel
