diff mbox

brcmfmac: move dereference under check for NULL

Message ID 20130606105556.GD12953@debian (mailing list archive)
State Not Applicable, archived
Headers show

Commit Message

Dan Carpenter June 6, 2013, 10:55 a.m. UTC 
skb_pull() dereferences the skb parameter.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Arend van Spriel June 6, 2013, 11:46 a.m. UTC | #1 
On 06/06/2013 12:55 PM, Dan Carpenter wrote:
> skb_pull() dereferences the skb parameter.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Hi Dan,

Just missed that. This code fragment was resubmitted just minutes ago. I 
will rework the patch to incorporate this change.

Regards,
Arend

> diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
> index ea37bd4..c35296f 100644
> --- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
> +++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
> @@ -861,9 +861,9 @@ static bool brcmf_fws_tim_update(struct brcmf_fws_info *fws,
>   		      BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN + 2 +
>   		      4 + fws->drvr->hdrlen;
>   		skb = brcmu_pkt_buf_get_skb(len);
> -		skb_pull(skb, len);
>   		if (skb == NULL)
>   			return false;
> +		skb_pull(skb, len);
>   		skcb = brcmf_skbcb(skb);
>   		skcb->mac = entry;
>   		skcb->state = BRCMF_FWS_SKBSTATE_TIM;
>


--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
index ea37bd4..c35296f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -861,9 +861,9 @@  static bool brcmf_fws_tim_update(struct brcmf_fws_info *fws,
 		      BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN + 2 +
 		      4 + fws->drvr->hdrlen;
 		skb = brcmu_pkt_buf_get_skb(len);
-		skb_pull(skb, len);
 		if (skb == NULL)
 			return false;
+		skb_pull(skb, len);
 		skcb = brcmf_skbcb(skb);
 		skcb->mac = entry;
 		skcb->state = BRCMF_FWS_SKBSTATE_TIM;