diff options
| author | Larry Finger <Larry.Finger@lwfinger.net> | 2010-08-31 10:15:26 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-08-31 10:59:53 -0700 |
| commit | 2e04fc838a1dc0afab7e788a90f39110d1cf922d (patch) | |
| tree | a76507755f6c77225a84206f19b9b6a595403fb0 /drivers/staging/rtl8712 | |
| parent | d19b86473ec1c72fe657841c57ca8924f3df42f0 (diff) | |
| download | op-kernel-dev-2e04fc838a1dc0afab7e788a90f39110d1cf922d.zip op-kernel-dev-2e04fc838a1dc0afab7e788a90f39110d1cf922d.tar.gz | |
staging: r8712u: Fix potential crash issue
When the driver received the Addba request frame from AP, a crash could
occur.
Signed-off-by: Albert Wang <albert_wang@realtek.com.tw>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/staging/rtl8712')
| -rw-r--r-- | drivers/staging/rtl8712/rtl871x_mlme.c | 18 |
1 files changed, 8 insertions, 10 deletions
diff --git a/drivers/staging/rtl8712/rtl871x_mlme.c b/drivers/staging/rtl8712/rtl871x_mlme.c index fb3508a..98ba760 100644 --- a/drivers/staging/rtl8712/rtl871x_mlme.c +++ b/drivers/staging/rtl8712/rtl871x_mlme.c @@ -1036,21 +1036,19 @@ void r8712_got_addbareq_event_callback(struct _adapter *adapter, u8 *pbuf) struct sta_info *psta; struct sta_priv *pstapriv = &adapter->stapriv; struct recv_reorder_ctrl *precvreorder_ctrl = NULL; - struct __queue *ppending_recvframe_queue = NULL; - unsigned long irql; printk(KERN_INFO "r8712u: [%s] mac = %pM, seq = %d, tid = %d\n", __func__, pAddbareq_pram->MacAddress, pAddbareq_pram->StartSeqNum, pAddbareq_pram->tid); psta = r8712_get_stainfo(pstapriv, pAddbareq_pram->MacAddress); - precvreorder_ctrl = &psta->recvreorder_ctrl[pAddbareq_pram->tid]; - ppending_recvframe_queue = &precvreorder_ctrl->pending_recvframe_queue; - spin_lock_irqsave(&ppending_recvframe_queue->lock, irql); - r8712_recv_indicatepkts_in_order(adapter, precvreorder_ctrl, true); - spin_unlock_irqrestore(&ppending_recvframe_queue->lock, irql); - /* set the indicate_seq to 0xffff so that the rx reorder can store - * any following data packet.*/ - precvreorder_ctrl->indicate_seq = 0xffff; + if (psta) { + precvreorder_ctrl = + &psta->recvreorder_ctrl[pAddbareq_pram->tid]; + /* set the indicate_seq to 0xffff so that the rx reorder + * can store any following data packet. + */ + precvreorder_ctrl->indicate_seq = 0xffff; + } } void r8712_wpspbc_event_callback(struct _adapter *adapter, u8 *pbuf) |
