Hello, I found this with a source code checker (http://repo.or.cz/w/smatch.git). We free "cmd" on line 390 and then dereference it on line 396. I don't know what we should return in that case or I would have sent a patch. Sorry. drivers/net/wireless/iwmc3200wifi/hal.c 390 if (!udma_cmd->resp) 391 kfree(cmd); 392 393 if (ret < 0) 394 return ret; 395 396 return cmd->seq_num; regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
