diff options
Diffstat (limited to 'package/kernel/mac80211/patches/360-0002-brcmfmac-make-brcmf_p2p_detach-call-conditional.patch')
| -rw-r--r-- | package/kernel/mac80211/patches/360-0002-brcmfmac-make-brcmf_p2p_detach-call-conditional.patch | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/package/kernel/mac80211/patches/360-0002-brcmfmac-make-brcmf_p2p_detach-call-conditional.patch b/package/kernel/mac80211/patches/360-0002-brcmfmac-make-brcmf_p2p_detach-call-conditional.patch new file mode 100644 index 0000000000..e4f88b5022 --- /dev/null +++ b/package/kernel/mac80211/patches/360-0002-brcmfmac-make-brcmf_p2p_detach-call-conditional.patch @@ -0,0 +1,29 @@ +From: Arend van Spriel <arend@broadcom.com> +Date: Mon, 15 Jun 2015 22:48:39 +0200 +Subject: [PATCH] brcmfmac: make brcmf_p2p_detach() call conditional + +During verification of error handling in brcmf_cfg80211_attach() a +null pointer dereference occurred upon calling brcmf_p2p_detach() +from brcmf_detach(). This should only be called when the +brcmf_cfg80211_attach() has succeeded. + +Fixes: f7a40873d2fa ("brcmfmac: assure p2pdev is unregistered upon driver unload") +Reviewed-by: Hante Meuleman <meuleman@broadcom.com> +Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com> +Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com> +Signed-off-by: Arend van Spriel <arend@broadcom.com> +Signed-off-by: Kalle Valo <kvalo@codeaurora.org> +--- + +--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c ++++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c +@@ -1098,7 +1098,8 @@ void brcmf_detach(struct device *dev) + + /* stop firmware event handling */ + brcmf_fweh_detach(drvr); +- brcmf_p2p_detach(&drvr->config->p2p); ++ if (drvr->config) ++ brcmf_p2p_detach(&drvr->config->p2p); + + brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN); + |