brcmf_p2p_send_action_frame() checks the P2P device vif saved probe request IE when deciding whether to perform a peer channel search. The P2P device vif is not guaranteed to exist, for example in standalone AP mode where no P2P device interface has been created. If a search-channel action frame is sent on a social channel in that mode, the validation condition can dereference the NULL P2P device vif before the frame is transmitted through the caller's vif. Guard the P2P device vif before checking its saved probe request IE. Fixes: 6eda4e2c5425 ("brcmfmac: Add tx p2p off-channel support.") Signed-off-by: Guangshuo Li --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c index 92c16a317328..bbdebf4c2010 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c @@ -1819,6 +1819,7 @@ bool brcmf_p2p_send_action_frame(struct brcmf_if *ifp, /* validate channel and p2p ies */ if (config_af_params.search_channel && IS_P2P_SOCIAL_CHANNEL(le32_to_cpu(af_params->channel)) && + p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif && p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif->saved_ie.probe_req_ie_len) { afx_hdl = &p2p->afx_hdl; afx_hdl->peer_listen_chan = le32_to_cpu(af_params->channel); -- 2.43.0