From 3f94bfe6febc9762e340a69b6520242f27d20c85 Mon Sep 17 00:00:00 2001
From: Wright Feng <wright.feng@cypress.com>
Date: Wed, 21 Nov 2018 03:16:55 -0600
Subject: [PATCH] MLK-21161-02 brcmfmac: validate ifp pointer in
brcmf_txfinalize
We got ifp null pointer kernel panic in brcmf_txfinalize after removing
Wi-Fi USB dongle when data was transmitting, The root cause is that
interface was removed before calling brcmf_txfinalize in
brcmf_fws_dequeue_worker and finally caused kernel panic.
Signed-off-by: Wright Feng <wright.feng@cypress.com>
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index 03e55789341c2f..94f5c8c07ecd60 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -370,6 +370,11 @@ void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success)
struct ethhdr *eh;
u16 type;
+ if (!ifp) {
+ brcmu_pkt_buf_free_skb(txp);
+ return;
+ }
+
eh = (struct ethhdr *)(txp->data);
type = ntohs(eh->h_proto);
--
GitLab