Commit 73e1a65d authored by Zhu Yi's avatar Zhu Yi Committed by John W. Linville
Browse files

iwlwifi: remove CMD_WANT_SKB flag if send_cmd_sync failure

In function iwl_send_cmd_sync(), if the flag CMD_WANT_SKB is set but
we are not provided with a valid SKB (cmd->meta.u.skb == NULL), we need
to remove the CMD_WANT_SKB flag from the TX cmd queue. Otherwise in case
the cmd comes in later, it will possibly set an invalid address. Thus
it causes an invalid memory access.

This fixed the bug http://bugzilla.kernel.org/show_bug.cgi?id=11326

.
Signed-off-by: default avatarZhu Yi <yi.zhu@intel.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 9d97f2e5
...@@ -224,7 +224,7 @@ int iwl_send_cmd_sync(struct iwl_priv *priv, struct iwl_host_cmd *cmd) ...@@ -224,7 +224,7 @@ int iwl_send_cmd_sync(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
IWL_ERROR("Error: Response NULL in '%s'\n", IWL_ERROR("Error: Response NULL in '%s'\n",
get_cmd_string(cmd->id)); get_cmd_string(cmd->id));
ret = -EIO; ret = -EIO;
goto out; goto cancel;
} }
ret = 0; ret = 0;
......
...@@ -745,7 +745,7 @@ static int iwl3945_send_cmd_sync(struct iwl3945_priv *priv, struct iwl3945_host_ ...@@ -745,7 +745,7 @@ static int iwl3945_send_cmd_sync(struct iwl3945_priv *priv, struct iwl3945_host_
IWL_ERROR("Error: Response NULL in '%s'\n", IWL_ERROR("Error: Response NULL in '%s'\n",
get_cmd_string(cmd->id)); get_cmd_string(cmd->id));
ret = -EIO; ret = -EIO;
goto out; goto cancel;
} }
ret = 0; ret = 0;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment