Re: [patch] brcmsmac: NULL dereferences in brcms_c_detach_mfree()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 28-11-14 10:43, Dan Carpenter wrote:
> The brcms_c_attach_malloc() function can call this with a NULL
> "wlc->corestate" or "wlc->hw".
> 
> Also I threw in a bonus cleanup by deleting an obvious comment and a
> no-op NULL assignment.  :)

Thanks for the patch+bonus

Acked-by: Arend van Spriel <arend@xxxxxxxxxxxx>
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> 
> diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
> index 738cfac..a104d7a 100644
> --- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
> +++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
> @@ -445,18 +445,18 @@ static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
>  	kfree(wlc->protection);
>  	kfree(wlc->stf);
>  	kfree(wlc->bandstate[0]);
> -	kfree(wlc->corestate->macstat_snapshot);
> +	if (wlc->corestate)
> +		kfree(wlc->corestate->macstat_snapshot);
>  	kfree(wlc->corestate);
> -	kfree(wlc->hw->bandstate[0]);
> +	if (wlc->hw)
> +		kfree(wlc->hw->bandstate[0]);
>  	kfree(wlc->hw);
>  	if (wlc->beacon)
>  		dev_kfree_skb_any(wlc->beacon);
>  	if (wlc->probe_resp)
>  		dev_kfree_skb_any(wlc->probe_resp);
>  
> -	/* free the wlc */
>  	kfree(wlc);
> -	wlc = NULL;
>  }
>  
>  static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)
> 

--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Kernel Development]     [Kernel Announce]     [Kernel Newbies]     [Linux Networking Development]     [Share Photos]     [IDE]     [Security]     [Git]     [Netfilter]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Device Mapper]

  Powered by Linux