diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2014-11-28 12:43:40 +0300 |
|---|---|---|
| committer |   John W. Linville <linville@tuxdriver.com> | 2014-12-01 15:57:21 -0500 |
| commit | c0fb754bd81fafcd63644d5482ba9669d3e4fe9c (patch) | |
| tree | a50074dec58a074476e5b5edbecb3a518c983bb3 /drivers/net/wireless | |
| parent | Revert "rt2x00: Endless loop on hub port power down" (diff) | |
| download | linux-dev-c0fb754bd81fafcd63644d5482ba9669d3e4fe9c.tar.xz linux-dev-c0fb754bd81fafcd63644d5482ba9669d3e4fe9c.zip | |
brcmsmac: NULL dereferences in brcms_c_detach_mfree()
The brcms_c_attach_malloc() function can call this with a NULL
"wlc->corestate" or "wlc->hw".
Also I threw in a bonus cleanup by deleting an obvious comment and a
no-op NULL assignment. :)
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless')
| -rw-r--r-- | drivers/net/wireless/brcm80211/brcmsmac/main.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c index 738cfaca1e0f..a104d7ac3796 100644 --- a/drivers/net/wireless/brcm80211/brcmsmac/main.c +++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c @@ -445,18 +445,18 @@ static void brcms_c_detach_mfree(struct brcms_c_info *wlc) kfree(wlc->protection); kfree(wlc->stf); kfree(wlc->bandstate[0]); - kfree(wlc->corestate->macstat_snapshot); + if (wlc->corestate) + kfree(wlc->corestate->macstat_snapshot); kfree(wlc->corestate); - kfree(wlc->hw->bandstate[0]); + if (wlc->hw) + kfree(wlc->hw->bandstate[0]); kfree(wlc->hw); if (wlc->beacon) dev_kfree_skb_any(wlc->beacon); if (wlc->probe_resp) dev_kfree_skb_any(wlc->probe_resp); - /* free the wlc */ kfree(wlc); - wlc = NULL; } static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit) |