FIX kernel panic after plugin USB WiFi Adapter - notifier NULL pointer dereference

Author: Svirusx

drivers/net/wireless/bcmdhd/wl_cfg80211.c

@@ -10903,13 +10903,23 @@ wl_cfg80211_netdev_notifier_call(struct notifier_block * nb,
 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 #endif /* LINUX_VERSION < VERSION(3, 11, 0) */
 
-	struct wireless_dev *wdev = ndev_to_wdev(dev);
-	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	struct wireless_dev *wdev;
+	struct bcm_cfg80211 *cfg;
 
 	WL_DBG(("Enter \n"));
+	if (!dev || !ndev_to_wdev(dev))
+		return NOTIFY_DONE;
 
-	if (!wdev || !cfg || dev == bcmcfg_to_prmry_ndev(cfg))
+       cfg = wl_get_cfg(dev);
+       if ((!cfg || ndev_to_wdev(dev) != cfg->wdev)) { 
 		return NOTIFY_DONE;
+       }
+
+       if (dev == bcmcfg_to_prmry_ndev(cfg)) {
+	       return NOTIFY_DONE;
+       }
+
+               wdev = ndev_to_wdev(dev); 
 
 	switch (state) {
 		case NETDEV_DOWN:

drivers/net/wireless/bcmdhd_1_77/wl_cfg80211.c

@@ -15084,13 +15084,23 @@ wl_cfg80211_netdev_notifier_call(struct notifier_block * nb,
 #else
 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 #endif /* LINUX_VERSION < VERSION(3, 11, 0) */
-	struct wireless_dev *wdev = ndev_to_wdev(dev);
-	struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+	struct wireless_dev *wdev;
+	struct bcm_cfg80211 *cfg;
 
 	WL_DBG(("Enter \n"));
+	if (!dev || !ndev_to_wdev(dev))
+		return NOTIFY_DONE;
 
-	if (!wdev || !cfg || dev == bcmcfg_to_prmry_ndev(cfg))
+	cfg = wl_get_cfg(dev);
+	if ((!cfg || ndev_to_wdev(dev) != cfg->wdev)) {
 		return NOTIFY_DONE;
+	}
+
+	if (dev == bcmcfg_to_prmry_ndev(cfg)) {
+		return NOTIFY_DONE;
+	}
+
+	        wdev = ndev_to_wdev(dev);
 
 	switch (state) {
 		case NETDEV_DOWN:

drivers/net/wireless/bcmdhd_1_77_nn/wl_cfg80211.c

@@ -14705,13 +14705,23 @@ wl_cfg80211_netdev_notifier_call(struct notifier_block * nb,
 #else
 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 #endif /* LINUX_VERSION < VERSION(3, 11, 0) */
-	struct wireless_dev *wdev = ndev_to_wdev(dev);
-	struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+	struct wireless_dev *wdev;
+	struct bcm_cfg80211 *cfg;
 
 	WL_DBG(("Enter \n"));
+	if (!dev || !ndev_to_wdev(dev))
+		return NOTIFY_DONE;
 
-	if (!wdev || !cfg || dev == bcmcfg_to_prmry_ndev(cfg))
+	cfg = wl_get_cfg(dev);
+	if ((!cfg || ndev_to_wdev(dev) != cfg->wdev)) {
 		return NOTIFY_DONE;
+	}
+
+	if (dev == bcmcfg_to_prmry_ndev(cfg)) {
+		return NOTIFY_DONE;
+	}
+
+	        wdev = ndev_to_wdev(dev);
 
 	switch (state) {
 		case NETDEV_DOWN: