From: Avraham Stern <[email protected]> iwl_mvm_te_clear_data() is called for cleanup in case sending the HOT_SPOT_CMD failed. However, in case sending the command caused a fw error and restart (e.g. if the command is not supported) then the te_data pointer may no longer be valid, which leads to a NULL pointer dereference.
Fix it by checking that the te_data pointer is not NULL before dereferencing it. Signed-off-by: Avraham Stern <[email protected]> Signed-off-by: Luca Coelho <[email protected]> --- drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c index 5b34100e9099..9693fa4cdc39 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c @@ -85,7 +85,7 @@ void iwl_mvm_te_clear_data(struct iwl_mvm *mvm, { lockdep_assert_held(&mvm->time_event_lock); - if (!te_data->vif) + if (!te_data || !te_data->vif) return; list_del(&te_data->list); -- 2.20.1
