mac80211: brcmfmac: fix a possible NULL pointer dereference

[openwrt/openwrt.git] / package / kernel / mac80211 / patches / brcm / 860-brcmfmac-register-wiphy-s-during-module_init.patch

diff --git a/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch b/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch
index 6452d81db5f22190d29fcefb4ddaf3064cb6b38d..aa0110c22d6b1c5e0d29c79cc78dbf265041fd8e 100644 (file)
--- a/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch
+++ b/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch
@@ -40,15 +40,16 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
        kfree(fwctx);
  }
  
-@@ -673,6 +676,7 @@ int brcmf_fw_get_firmwares(struct device
+@@ -673,6 +676,8 @@ int brcmf_fw_get_firmwares(struct device
  {
        struct brcmf_fw_item *first = &req->items[0];
        struct brcmf_fw *fwctx;
 +      struct completion completion;
++      unsigned long time_left;
        int ret;
  
        brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
-@@ -689,6 +693,9 @@ int brcmf_fw_get_firmwares(struct device
+@@ -689,6 +694,9 @@ int brcmf_fw_get_firmwares(struct device
        fwctx->dev = dev;
        fwctx->req = req;
        fwctx->done = fw_cb;
@@ -58,11 +59,15 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
  
        ret = request_firmware_nowait(THIS_MODULE, true, first->path,
                                      fwctx->dev, GFP_KERNEL, fwctx,
-@@ -696,6 +703,8 @@ int brcmf_fw_get_firmwares(struct device
+@@ -696,6 +704,12 @@ int brcmf_fw_get_firmwares(struct device
        if (ret < 0)
                brcmf_fw_request_done(NULL, fwctx);
  
-+      wait_for_completion_timeout(&completion, msecs_to_jiffies(5000));
++
++      time_left = wait_for_completion_timeout(&completion,
++                                              msecs_to_jiffies(5000));
++      if (!time_left && fwctx)
++              fwctx->completion = NULL;
 +
        return 0;
  }