From: Antonio Quartulli Date: Wed, 19 Jun 2013 11:35:31 +0000 (+0200) Subject: brcm80211: fix null pointer access X-Git-Tag: v3.11-rc1~64^2~78^2^2~44 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=86a9c4a28b2c1a367d340db53570ebea02f33fca;p=platform%2Fupstream%2Fkernel-adaptation-pc.git brcm80211: fix null pointer access Do not unconditionally access the chan variable in brcmf_cfg80211_mgmt_tx() as it may be NULL. Use freq instead. Introduced by c2ff8cad64233b539c71a27e2a6e324001143ef0 ("brcm80211: make mgmt_tx in brcmfmac accept a NULL channel") Reported-by: Dan Carpenter Signed-off-by: Antonio Quartulli Signed-off-by: John W. Linville --- diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c index 71f4db5..277b37a 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c @@ -4050,8 +4050,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, le16_to_cpu(action_frame->len)); brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n", - *cookie, le16_to_cpu(action_frame->len), - chan->center_freq); + *cookie, le16_to_cpu(action_frame->len), freq); ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg), af_params);