From: Samuel Ortiz <sameo@linux.intel.com>
Date: Fri, 16 Oct 2009 05:18:55 +0000 (+0800)
Subject: iwmc3200wifi: Check for cmd pointer before dereferencing it
X-Git-Url: http://drtracing.org/?a=commitdiff_plain;h=708567e0723f3a217286c2b60805af6de360ec50;p=deliverable%2Flinux.git

iwmc3200wifi: Check for cmd pointer before dereferencing it

The wifi_if_wrapper notification handling code uses a cmd pointer without
checking if it's valid or not. We're dereferencing it because we assume that
we only get to that point if there was a pending command for us. That's not
always true, so we'd better check.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---

diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c
index 225b1d3b2735..648f84a83705 100644
--- a/drivers/net/wireless/iwmc3200wifi/rx.c
+++ b/drivers/net/wireless/iwmc3200wifi/rx.c
@@ -1057,8 +1057,14 @@ static int iwm_ntf_wifi_if_wrapper(struct iwm_priv *iwm, u8 *buf,
 				   unsigned long buf_size,
 				   struct iwm_wifi_cmd *cmd)
 {
-	struct iwm_umac_wifi_if *hdr =
-			(struct iwm_umac_wifi_if *)cmd->buf.payload;
+	struct iwm_umac_wifi_if *hdr;
+
+	if (cmd == NULL) {
+		IWM_ERR(iwm, "Couldn't find expected wifi command\n");
+		return -EINVAL;
+	}
+
+	hdr = (struct iwm_umac_wifi_if *)cmd->buf.payload;
 
 	IWM_DBG_NTF(iwm, DBG, "WIFI_IF_WRAPPER cmd is delivered to UMAC: "
 		    "oid is 0x%x\n", hdr->oid);