Allocation of buffer in function wl_ucode_init_buf can fail. This was signalled by an error message, but code continued to access the null pointer. This is now avoided by jumping to failure label.
Reviewed-by: Roland Vossen <[email protected]> Reviewed-by: Brett Rudley <[email protected]> Reviewed-by: Henry Ptasinski <[email protected]> Signed-off-by: Arend van Spriel <[email protected]> --- drivers/staging/brcm80211/brcmsmac/wl_mac80211.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c b/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c index 829cc7d..a0e4654 100644 --- a/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c +++ b/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c @@ -1743,6 +1743,7 @@ int wl_ucode_init_buf(struct wl_info *wl, void **pbuf, u32 idx) if (*pbuf == NULL) { WL_ERROR("fail to alloc %d bytes\n", hdr->len); + goto fail; } bcopy(pdata, *pbuf, hdr->len); return 0; @@ -1751,6 +1752,7 @@ int wl_ucode_init_buf(struct wl_info *wl, void **pbuf, u32 idx) } WL_ERROR("ERROR: ucode buf tag:%d can not be found!\n", idx); *pbuf = NULL; +fail: return -1; } -- 1.7.1 _______________________________________________ devel mailing list [email protected] http://driverdev.linuxdriverproject.org/mailman/listinfo/devel
