[PATCH] ath10k: Fix crash due to tasklet race.

[greearb at candelatech.com]

From: Ben Greear <greearb at candelatech.com>

The tasklet can run after the rings have been cleaned up,
so check for NULL before de-referencing the ring.

Signed-off-by: Ben Greear <greearb at candelatech.com>
---
 drivers/net/wireless/ath/ath10k/ce.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
index d243f28..dfcfda9 100644
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -547,12 +547,18 @@ static int ath10k_ce_completed_send_next_nolock(struct ath10k_ce_pipe *ce_state,
 	struct ath10k_ce_ring *src_ring = ce_state->src_ring;
 	u32 ctrl_addr = ce_state->ctrl_addr;
 	struct ath10k *ar = ce_state->ar;
-	unsigned int nentries_mask = src_ring->nentries_mask;
-	unsigned int sw_index = src_ring->sw_index;
+	unsigned int nentries_mask;
+	unsigned int sw_index;
 	struct ce_desc *sdesc, *sbase;
 	unsigned int read_index;
 	int ret;
 
+	if (!src_ring)
+		return -EIO;
+
+	nentries_mask = src_ring->nentries_mask;
+	sw_index = src_ring->sw_index;
+
 	if (src_ring->hw_index == sw_index) {
 		/*
 		 * The SW completion index has caught up with the cached
-- 
1.7.11.7