[PATCH] wifi: brcmfmac: guard P2P device vif in action frame search

[Guangshuo Li]

brcmf_p2p_send_action_frame() checks the P2P device vif saved probe
request IE when deciding whether to perform a peer channel search. The
P2P device vif is not guaranteed to exist, for example in standalone AP
mode where no P2P device interface has been created.

If a search-channel action frame is sent on a social channel in that
mode, the validation condition can dereference the NULL P2P device vif
before the frame is transmitted through the caller's vif.

Guard the P2P device vif before checking its saved probe request IE.

Fixes: 6eda4e2c5425 ("brcmfmac: Add tx p2p off-channel support.")
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index 92c16a317328..bbdebf4c2010 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -1819,6 +1819,7 @@ bool brcmf_p2p_send_action_frame(struct brcmf_if *ifp,
 	/* validate channel and p2p ies */
 	if (config_af_params.search_channel &&
 	    IS_P2P_SOCIAL_CHANNEL(le32_to_cpu(af_params->channel)) &&
+	    p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif &&
 	    p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif->saved_ie.probe_req_ie_len) {
 		afx_hdl = &p2p->afx_hdl;
 		afx_hdl->peer_listen_chan = le32_to_cpu(af_params->channel);
-- 
2.43.0