If kmemdup fails, then wl->nvs_len will contain invalid non-zero size.

Signed-off-by: Pali Rohár <pali.ro...@gmail.com>
Acked-by: Pavel Machek <pa...@ucw.cz>
---
 drivers/net/wireless/ti/wl1251/main.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ti/wl1251/main.c 
b/drivers/net/wireless/ti/wl1251/main.c
index 9915d83..8929bb3 100644
--- a/drivers/net/wireless/ti/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
@@ -122,8 +122,7 @@ static int wl1251_fetch_nvs(struct wl1251 *wl)
                goto out;
        }
 
-       wl->nvs_len = fw->size;
-       wl->nvs = kmemdup(fw->data, wl->nvs_len, GFP_KERNEL);
+       wl->nvs = kmemdup(fw->data, fw->size, GFP_KERNEL);
 
        if (!wl->nvs) {
                wl1251_error("could not allocate memory for the nvs file");
@@ -131,6 +130,8 @@ static int wl1251_fetch_nvs(struct wl1251 *wl)
                goto out;
        }
 
+       wl->nvs_len = fw->size;
+
        ret = 0;
 
 out:
-- 
1.7.9.5

Reply via email to