From: Ben Greear iwl_mld_txq_from_mac80211 was returning the offset into txq without checking if txq was NULL. In case txq is NULL, this would return a small, but non NULL pointer. The safety check in calling code would then treat it as non-null and attempt to dereference. Signed-off-by: Ben Greear --- drivers/net/wireless/intel/iwlwifi/mld/tx.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/intel/iwlwifi/mld/tx.h b/drivers/net/wireless/intel/iwlwifi/mld/tx.h index 520f15f9d33c..8b0da098c25f 100644 --- a/drivers/net/wireless/intel/iwlwifi/mld/tx.h +++ b/drivers/net/wireless/intel/iwlwifi/mld/tx.h @@ -45,6 +45,8 @@ static inline void iwl_mld_init_txq(struct iwl_mld_txq *mld_txq) static inline struct iwl_mld_txq * iwl_mld_txq_from_mac80211(struct ieee80211_txq *txq) { + if (!txq) + return NULL; return (void *)txq->drv_priv; } -- 2.42.0