Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c0fb754b authored by Dan Carpenter's avatar Dan Carpenter Committed by John W. Linville
Browse files

brcmsmac: NULL dereferences in brcms_c_detach_mfree() 



The brcms_c_attach_malloc() function can call this with a NULL
"wlc->corestate" or "wlc->hw".

Also I threw in a bonus cleanup by deleting an obvious comment and a
no-op NULL assignment.  :)

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarArend van Spriel <arend@broadcom.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent dc50a52a

drivers/net/wireless/brcm80211/brcmsmac/main.c

+4 −4
Original line number Diff line number Diff line
@@ -445,8 +445,10 @@ static void brcms_c_detach_mfree(struct brcms_c_info *wlc) 
	kfree(wlc->protection);

	kfree(wlc->stf);

	kfree(wlc->bandstate[0]);

	if (wlc->corestate)

		kfree(wlc->corestate->macstat_snapshot);

	kfree(wlc->corestate);

	if (wlc->hw)

		kfree(wlc->hw->bandstate[0]);

	kfree(wlc->hw);

	if (wlc->beacon)
@@ -454,9 +456,7 @@ static void brcms_c_detach_mfree(struct brcms_c_info *wlc) 
	if (wlc->probe_resp)

		dev_kfree_skb_any(wlc->probe_resp);



	/* free the wlc */

	kfree(wlc);

	wlc = NULL;

}



static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)