[PATCH 7/8] staging: brcm80211: fix potential null pointer access handling ucode buffer

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Allocation of buffer in function wl_ucode_init_buf can fail. This was
signalled by an error message, but code continued to access the null
pointer. This is now avoided by jumping to failure label.

Reviewed-by: Roland Vossen <rvossen@xxxxxxxxxxxx>
Reviewed-by: Brett Rudley <brudley@xxxxxxxxxxxx>
Reviewed-by: Henry Ptasinski <henryp@xxxxxxxxxxxx>
Signed-off-by: Arend van Spriel <arend@xxxxxxxxxxxx>
---
 drivers/staging/brcm80211/brcmsmac/wl_mac80211.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c b/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c
index 829cc7d..a0e4654 100644
--- a/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c
+++ b/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c
@@ -1743,6 +1743,7 @@ int wl_ucode_init_buf(struct wl_info *wl, void **pbuf, u32 idx)
 				if (*pbuf == NULL) {
 					WL_ERROR("fail to alloc %d bytes\n",
 						 hdr->len);
+					goto fail;
 				}
 				bcopy(pdata, *pbuf, hdr->len);
 				return 0;
@@ -1751,6 +1752,7 @@ int wl_ucode_init_buf(struct wl_info *wl, void **pbuf, u32 idx)
 	}
 	WL_ERROR("ERROR: ucode buf tag:%d can not be found!\n", idx);
 	*pbuf = NULL;
+fail:
 	return -1;
 }
 
-- 
1.7.1


_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/devel


[Index of Archives]     [Linux Driver Backports]     [DMA Engine]     [Linux GPIO]     [Linux SPI]     [Video for Linux]     [Linux USB Devel]     [Linux Coverity]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]
  Powered by Linux