Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3d4bd24b authored by Florin Malita's avatar Florin Malita Committed by John W. Linville
Browse files

[PATCH] libertas: skb dereferenced after netif_rx 



In libertas_process_rxed_packet() and process_rxed_802_11_packet() the
skb is dereferenced after being passed to netif_rx (called from
libertas_upload_rx_packet). Spotted by Coverity (1658, 1659).

Also, libertas_upload_rx_packet() unconditionally returns 0 so the error
check is dead code - might as well take it out and change the signature.

Signed-off-by: default avatarFlorin Malita <fmalita@gmail.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 55b637c6

drivers/net/wireless/libertas/decl.h

+1 −1
Original line number Diff line number Diff line
@@ -46,7 +46,7 @@ u32 libertas_index_to_data_rate(u8 index); 
u8 libertas_data_rate_to_index(u32 rate);

void libertas_get_fwversion(wlan_adapter * adapter, char *fwversion, int maxlen);



int libertas_upload_rx_packet(wlan_private * priv, struct sk_buff *skb);

void libertas_upload_rx_packet(wlan_private * priv, struct sk_buff *skb);



/** The proc fs interface */

int libertas_process_rx_command(wlan_private * priv);

drivers/net/wireless/libertas/rx.c

+5 −17
Original line number Diff line number Diff line
@@ -136,7 +136,7 @@ static void wlan_compute_rssi(wlan_private * priv, struct rxpd *p_rx_pd) 
	LEAVE();

}



int libertas_upload_rx_packet(wlan_private * priv, struct sk_buff *skb)

void libertas_upload_rx_packet(wlan_private * priv, struct sk_buff *skb)

{

	lbs_pr_debug(1, "skb->data=%p\n", skb->data);
@@ -148,8 +148,6 @@ int libertas_upload_rx_packet(wlan_private * priv, struct sk_buff *skb) 
	skb->ip_summed = CHECKSUM_UNNECESSARY;



	netif_rx(skb);



	return 0;

}



/**
@@ -269,15 +267,11 @@ int libertas_process_rxed_packet(wlan_private * priv, struct sk_buff *skb) 
	wlan_compute_rssi(priv, p_rx_pd);



	lbs_pr_debug(1, "RX Data: size of actual packet = %d\n", skb->len);

	if (libertas_upload_rx_packet(priv, skb)) {

		lbs_pr_debug(1, "RX error: libertas_upload_rx_packet"

		       " returns failure\n");

		ret = -1;

		goto done;

	}

	priv->stats.rx_bytes += skb->len;

	priv->stats.rx_packets++;



	libertas_upload_rx_packet(priv, skb);



	ret = 0;

done:

	LEAVE();
@@ -438,17 +432,11 @@ static int process_rxed_802_11_packet(wlan_private * priv, struct sk_buff *skb) 
	wlan_compute_rssi(priv, prxpd);



	lbs_pr_debug(1, "RX Data: size of actual packet = %d\n", skb->len);



	if (libertas_upload_rx_packet(priv, skb)) {

		lbs_pr_debug(1, "RX error: libertas_upload_rx_packet "

			"returns failure\n");

		ret = -1;

		goto done;

	}



	priv->stats.rx_bytes += skb->len;

	priv->stats.rx_packets++;



	libertas_upload_rx_packet(priv, skb);



	ret = 0;

done:

	LEAVE();