Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bb6e093d authored by Florin Malita's avatar Florin Malita Committed by Linus Torvalds
Browse files

[PATCH] orinoco: possible null pointer dereference in orinoco_rx_monitor() 



If the skb allocation fails, the current error path calls
dev_kfree_skb_irq() with a NULL argument.  Also, 'err' is not being used.

Coverity CID: 275.

Signed-off-by: default avatarFlorin Malita <fmalita@gmail.com>
Cc: "John W. Linville" <linville@tuxdriver.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 30d6b2f3

drivers/net/wireless/orinoco.c

+1 −3
Original line number Diff line number Diff line
@@ -812,7 +812,6 @@ static void orinoco_rx_monitor(struct net_device *dev, u16 rxfid, 
	if (datalen > IEEE80211_DATA_LEN + 12) {

		printk(KERN_DEBUG "%s: oversized monitor frame, "

		       "data length = %d\n", dev->name, datalen);

		err = -EIO;

		stats->rx_length_errors++;

		goto update_stats;

	}
@@ -821,8 +820,7 @@ static void orinoco_rx_monitor(struct net_device *dev, u16 rxfid, 
	if (!skb) {

		printk(KERN_WARNING "%s: Cannot allocate skb for monitor frame\n",

		       dev->name);

		err = -ENOMEM;

		goto drop;

		goto update_stats;

	}



	/* Copy the 802.11 header to the skb */