potential null deref in iwlagn_request_scan()?

[Dan Carpenter <error27@gmail.com>]

Smatch complains about iwlagn_request_scan().

drivers/net/wireless/iwlwifi/iwl-agn-lib.c +1354 iwlagn_request_scan(204)
	error: we previously assumed 'vif' could be null.

  1351          if (!priv->is_internal_short_scan) {
  1352                  cmd_len = iwl_fill_probe_req(priv,
  1353                                          (struct ieee80211_mgmt *)scan->data,
  1354                                          vif->addr,
						^^^^^^^^^

  1355                                          priv->scan_request->ie, 
  1356						priv->scan_request->ie_len,
  1357                                          IWL_MAX_SCAN_SIZE - sizeof(*scan));
  1358          } else {
  1359                  /* use bcast addr, will not be transmitted but must be valid */

This was added in 3a0b9aad0a8166e9f "iwlwifi: use virtual interface
address for scan".  Prior to that commit the function assumed that vif
could be NULL throughout.

I don't know the code well enough to know what to do about this.

Also the same thing for:
drivers/net/wireless/iwlwifi/iwl3945-base.c +2963 iwl3945_request_scan(158)
	error: we previously assumed 'vif' could be null.

  2962          if (!priv->is_internal_short_scan) {
  2963                  scan->tx_cmd.len = cpu_to_le16(
  2964                          iwl_fill_probe_req(priv,
  2965                                  (struct ieee80211_mgmt *)scan->data,
  2966                                  vif->addr,
					^^^^^^^^^
  2967                                  priv->scan_request->ie,
  2968                                  priv->scan_request->ie_len,
  2969                                  IWL_MAX_SCAN_SIZE - sizeof(*scan)));
  2970          } else {

This is from the above commit as well.

regards,
dan carpenter