armbian_build/patch/kernel/archive/sunxi-5.19/patches.megous/rtw88-fix-null-vif-pointer-when-hw_scan-fails.patch
The-going 97c6e5e9dd
sunxi-5.19: Initial state for megous patches (#4048)
* sunxi-5.19: Initial state for megous patches

* Add the ability to do 5.19

* Move to 5.19

- tested both
- removed broken Opi Zero xradio driver https://armbian.atlassian.net/browse/AR-1280

* sunxi-5.19: fix tag for switch

* sunxi-5.19: Initial state for armbian patches

* sunxi-5.19: Add armbian patches to series.conf file

* sanxi-5.19: Add other 2 patches

* sunxi-5.19: Limit to use the 'wireless/xradio' module

Limit the kernel version to less than 5.19 to use
the 'wireless/xradio' module

Co-authored-by: Igor Pecovnik <igor.pecovnik@gmail.com>
2022-08-05 21:23:49 +03:00

40 lines
1.5 KiB
Diff

From 8a3133a83b0e6d803ea3bb65950f6672854f3eb4 Mon Sep 17 00:00:00 2001
From: Po-Hao Huang <phhuang@realtek.com>
Date: Fri, 20 May 2022 16:15:23 +0800
Subject: [PATCH 382/417] rtw88: fix null vif pointer when hw_scan fails
Add this check to avoid crash by dereferencing a null pointer. When hwscan
fails due to no memory or dma failure, the scan flag in ieee80211_local is
cleared. So mac80211 determine that it's not hw_scan then calls
sw_scan_complete() with null vif, which is also freed during the fail.
Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220520081523.45987-1-pkshih@realtek.com
---
drivers/net/wireless/realtek/rtw88/main.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
index efabd5b1b..a44b18101 100644
--- a/drivers/net/wireless/realtek/rtw88/main.c
+++ b/drivers/net/wireless/realtek/rtw88/main.c
@@ -1383,9 +1383,12 @@ void rtw_core_scan_start(struct rtw_dev *rtwdev, struct rtw_vif *rtwvif,
void rtw_core_scan_complete(struct rtw_dev *rtwdev, struct ieee80211_vif *vif,
bool hw_scan)
{
- struct rtw_vif *rtwvif = (struct rtw_vif *)vif->drv_priv;
+ struct rtw_vif *rtwvif = vif ? (struct rtw_vif *)vif->drv_priv : NULL;
u32 config = 0;
+ if (!rtwvif)
+ return;
+
clear_bit(RTW_FLAG_SCANNING, rtwdev->flags);
clear_bit(RTW_FLAG_DIG_DISABLE, rtwdev->flags);
--
2.35.3