cfg80211: fix NULL pointer deference in reg_device_remove()

We won't ever get here as regulatory_hint_core() can only fail
on -ENOMEM and in that case we don't initialize cfg80211 but this is
technically correct code.

This is actually good for stable, where we don't check for -ENOMEM
failure on __regulatory_hint()'s failure.

Cc: stable@kernel.org
Reported-by: Quentin Armitage <Quentin@armitage.org.uk>
Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 6327e1617acbac5e7c34cc3ca9a038dfbed57fa4..6c1993d99902aaa41d676ea72cf1f1a625892b61 100644 (file)
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2095,11 +2095,12 @@ int set_regdom(const struct ieee80211_regdomain *rd)
 /* Caller must hold cfg80211_mutex */
 void reg_device_remove(struct wiphy *wiphy)
 {
-       struct wiphy *request_wiphy;
+       struct wiphy *request_wiphy = NULL;
 
        assert_cfg80211_lock();
 
-       request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
+       if (last_request)
+               request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
 
        kfree(wiphy->regd);
        if (!last_request || !request_wiphy)