From patchwork Sun Apr 17 13:25:03 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: per.forlin@gmail.com X-Patchwork-Id: 8862831 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 3D0A29F441 for ; Sun, 17 Apr 2016 13:29:56 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 6288A201BC for ; Sun, 17 Apr 2016 13:29:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 82B5A20154 for ; Sun, 17 Apr 2016 13:29:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753027AbcDQNZk (ORCPT ); Sun, 17 Apr 2016 09:25:40 -0400 Received: from mail-lf0-f48.google.com ([209.85.215.48]:35607 "EHLO mail-lf0-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751673AbcDQNZj (ORCPT ); Sun, 17 Apr 2016 09:25:39 -0400 Received: by mail-lf0-f48.google.com with SMTP id c126so190527812lfb.2 for ; Sun, 17 Apr 2016 06:25:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id; bh=R6KYtZOwwYe3l+CPVV2cc79MirLTUloyCg5+Vf+Eexc=; b=n79EdUokxyAL45Femmp7sc4YqmnnR9oLr0CzwRdK4Die+C2xxe/Y/EeNyqX0aM0SpO smalM6o2PdrPY2uvt0ENbnngT6qox4H1dYMxcxrcIcG4djVJRBav5TrFWpCGP9Nw2Ls9 X3h8m5SlylYmXLOYXXe4hnHKNtY+SxQup/9d6OK/4YcMYrwL7419kJWS7+c9/XQqfVd/ Uz3W2++B07hEEJ1aUJ2n42698AQ5+nZ90S3EchlWGpadMax2f8bi+RnD1hUK2eOfYzE8 ujXuWqd9HlarMrnyMn+t2QY+J1XEw816+VzgbJOApMwM/C5ZdPDBFrsn3sCLPXlJL9z4 Dc5A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=R6KYtZOwwYe3l+CPVV2cc79MirLTUloyCg5+Vf+Eexc=; b=S3mqfucxEVirtZJ9yMDN8YaWzKlO/Qz5i8gCJPc5yMJJV1L8GCAyLX3dGl6ir2dcTB PH58GF5m15ajMJTnadaqgGYn7JvRWmuRRurQqh1XZivAp+e0lS9JFVa1WVtNNj2z7ATU 5VM+bZ+nWyCDbfUly9W/dPDmjLmqwbT8wTCc99u2K2udRqtaWwXoDVRJuuV5KBi+Bl2B +udvQtj++QSaQ54LyUhZSZeNIrlQ9poYr3O47eE748SZpqIE0m18KYXPYoU+L3A64eVM LuePXGmZ+aB+4AVcgTePIpFyzaQlfGXeFttzJLPkY1Op3kAigucmZvSM3d+REEiu4gkS ZN1Q== X-Gm-Message-State: AOPr4FWmevZjBr+0Ip2pa3jLYifpOCFbVtS6jXvD3Zk0J+azsJQsBqBETpjPXjHXCgEOSA== X-Received: by 10.25.208.144 with SMTP id h138mr10140074lfg.48.1460899537122; Sun, 17 Apr 2016 06:25:37 -0700 (PDT) Received: from localhost.localdomain (109-104-20-244.customers.ownit.se. [109.104.20.244]) by smtp.gmail.com with ESMTPSA id r130sm8770189lfe.6.2016.04.17.06.25.36 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 17 Apr 2016 06:25:36 -0700 (PDT) From: per.forlin@gmail.com To: linux-wireless@vger.kernel.org Cc: arend@broadcom.com, brudley@broadcom.com, Per Forlin Subject: [PATCH] brcmf: Fix null pointer exception in bcdc_hdrpull Date: Sun, 17 Apr 2016 15:25:03 +0200 Message-Id: <1460899503-5245-1-git-send-email-per.forlin@gmail.com> X-Mailer: git-send-email 2.1.4 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-7.8 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Per Forlin In fwsignal.c: brcmf_fws_commit_skb() ... if (rc < 0) { entry->transit_count--; if (entry->suppressed) entry->suppr_transit_count--; (void)brcmf_proto_hdrpull(fws->drvr, false, skb, NULL); ^^^^^^^ goto rollback; } ... The call to hdrpull will trigger a null pointer exception unless a null check is made in the method implementation. Signed-off-by: Per Forlin --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c index 6af658e..81727da2 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c @@ -321,7 +321,8 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pub *drvr, bool do_fws, if (pktbuf->len == 0) return -ENODATA; - *ifp = tmp_if; + if (ifp != NULL) + *ifp = tmp_if; return 0; }