From: Avraham Stern Date: Thu, 7 Dec 2023 02:50:17 +0000 (+0200) Subject: wifi: iwlwifi: pcie: avoid a NULL pointer dereference X-Git-Tag: v6.6.14~638 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=015cfa30b39c517eea226a41349b1ec41efffada;p=platform%2Fkernel%2Flinux-starfive.git wifi: iwlwifi: pcie: avoid a NULL pointer dereference [ Upstream commit ce038edfce43fb345f8dfdca0f7b17f535896701 ] It possible that while the rx rb is being handled, the transport has been stopped and re-started. In this case the tx queue pointer is not yet initialized, which will lead to a NULL pointer dereference. Fix it. Signed-off-by: Avraham Stern Signed-off-by: Miri Korenblit Link: https://msgid.link/20231207044813.cd0898cafd89.I0b84daae753ba9612092bf383f5c6f761446e964@changeid Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin --- diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c index a9415d333490..63091c45a576 100644 --- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c @@ -1385,7 +1385,7 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans, * if it is true then one of the handlers took the page. */ - if (reclaim) { + if (reclaim && txq) { u16 sequence = le16_to_cpu(pkt->hdr.sequence); int index = SEQ_TO_INDEX(sequence); int cmd_index = iwl_txq_get_cmd_index(txq, index);