Commit 8746e2ba authored Feb 10, 2011 by Arend van Spriel Committed by Greg Kroah-Hartman Feb 18, 2011

staging: brcm80211: fix potential null pointer access handling ucode buffer



Allocation of buffer in function wl_ucode_init_buf can fail. This was
signalled by an error message, but code continued to access the null
pointer. This is now avoided by jumping to failure label.

Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Brett Rudley <brudley@broadcom.com>
Reviewed-by: Henry Ptasinski <henryp@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

parent 0bef7748

drivers/staging/brcm80211/brcmsmac/wl_mac80211.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -1707,6 +1707,7 @@ int wl_ucode_init_buf(struct wl_info wl, void *pbuf, u32 idx)
		if (*pbuf == NULL) {
		WL_ERROR("fail to alloc %d bytes\n",
		hdr->len);
		goto fail;
		}
		bcopy(pdata, *pbuf, hdr->len);
		return 0;
		@@ -1715,6 +1716,7 @@ int wl_ucode_init_buf(struct wl_info wl, void *pbuf, u32 idx)
		}
		WL_ERROR("ERROR: ucode buf tag:%d can not be found!\n", idx);
		*pbuf = NULL;
		fail:
		return -1;
		}