diff options
| author | Avinash Patil <patila@marvell.com> | 2014-05-13 19:50:13 -0700 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2014-05-16 14:26:53 -0400 |
| commit | 8d767dcbea32ef9c1c1640ee8dde7db3e1e36f4a (patch) | |
| tree | b123f81cfbb2baeda1c37a7888241807d18ede70 /drivers/net/wireless/mwifiex/pcie.c | |
| parent | bb71d01a42491704073dfc3c1f90974890eba4d6 (diff) | |
mwifiex: set valid tx_param during mwifiex_send_null_packet
While sending null packet from driver we are passing NULL
tx_param pointer to indicate there are no more packets in queue.
PCIe send routine assumes caller has done sanity check on
tx_param and may cause crash while dereferencing next_pkt_len
from tx_param.
Avoid this by passing tx_param structure with next_pkt_len as
zero instead of NULL pointer.
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/mwifiex/pcie.c')
| -rw-r--r-- | drivers/net/wireless/mwifiex/pcie.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c index c2cfeec466d8..574d4b597468 100644 --- a/drivers/net/wireless/mwifiex/pcie.c +++ b/drivers/net/wireless/mwifiex/pcie.c @@ -1071,6 +1071,7 @@ static int mwifiex_pcie_send_data_complete(struct mwifiex_adapter *adapter) * is mapped to PCI device memory. Tx ring pointers are advanced accordingly. * Download ready interrupt to FW is deffered if Tx ring is not full and * additional payload can be accomodated. + * Caller must ensure tx_param parameter to this function is not NULL. */ static int mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb, |