aboutsummaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorSamuel Ortiz <sameo@linux.intel.com>2009-10-16 13:18:55 +0800
committerJohn W. Linville <linville@tuxdriver.com>2009-10-27 16:48:26 -0400
commit708567e0723f3a217286c2b60805af6de360ec50 (patch)
tree7ae30ebce5cf1fcdee80ce985ad1272ef3e82342 /drivers
parentf96cca8483c1b0bcc8002dc466159bf8fd53ca47 (diff)
iwmc3200wifi: Check for cmd pointer before dereferencing it
The wifi_if_wrapper notification handling code uses a cmd pointer without checking if it's valid or not. We're dereferencing it because we assume that we only get to that point if there was a pending command for us. That's not always true, so we'd better check. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: Zhu Yi <yi.zhu@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/net/wireless/iwmc3200wifi/rx.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c
index 225b1d3b273..648f84a8370 100644
--- a/drivers/net/wireless/iwmc3200wifi/rx.c
+++ b/drivers/net/wireless/iwmc3200wifi/rx.c
@@ -1057,8 +1057,14 @@ static int iwm_ntf_wifi_if_wrapper(struct iwm_priv *iwm, u8 *buf,
unsigned long buf_size,
struct iwm_wifi_cmd *cmd)
{
- struct iwm_umac_wifi_if *hdr =
- (struct iwm_umac_wifi_if *)cmd->buf.payload;
+ struct iwm_umac_wifi_if *hdr;
+
+ if (cmd == NULL) {
+ IWM_ERR(iwm, "Couldn't find expected wifi command\n");
+ return -EINVAL;
+ }
+
+ hdr = (struct iwm_umac_wifi_if *)cmd->buf.payload;
IWM_DBG_NTF(iwm, DBG, "WIFI_IF_WRAPPER cmd is delivered to UMAC: "
"oid is 0x%x\n", hdr->oid);