diff mbox

brcmsmac: NULL dereferences in brcms_c_detach_mfree()

Message ID 20141128094340.GA10364@mwanda (mailing list archive)
State Not Applicable, archived
Headers show

Commit Message

Dan Carpenter Nov. 28, 2014, 9:43 a.m. UTC
The brcms_c_attach_malloc() function can call this with a NULL
"wlc->corestate" or "wlc->hw".

Also I threw in a bonus cleanup by deleting an obvious comment and a
no-op NULL assignment.  :)

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Arend van Spriel Nov. 28, 2014, 10:08 a.m. UTC | #1
On 28-11-14 10:43, Dan Carpenter wrote:
> The brcms_c_attach_malloc() function can call this with a NULL
> "wlc->corestate" or "wlc->hw".
> 
> Also I threw in a bonus cleanup by deleting an obvious comment and a
> no-op NULL assignment.  :)

Thanks for the patch+bonus

Acked-by: Arend van Spriel <arend@broadcom.com>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
> index 738cfac..a104d7a 100644
> --- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
> +++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
> @@ -445,18 +445,18 @@ static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
>  	kfree(wlc->protection);
>  	kfree(wlc->stf);
>  	kfree(wlc->bandstate[0]);
> -	kfree(wlc->corestate->macstat_snapshot);
> +	if (wlc->corestate)
> +		kfree(wlc->corestate->macstat_snapshot);
>  	kfree(wlc->corestate);
> -	kfree(wlc->hw->bandstate[0]);
> +	if (wlc->hw)
> +		kfree(wlc->hw->bandstate[0]);
>  	kfree(wlc->hw);
>  	if (wlc->beacon)
>  		dev_kfree_skb_any(wlc->beacon);
>  	if (wlc->probe_resp)
>  		dev_kfree_skb_any(wlc->probe_resp);
>  
> -	/* free the wlc */
>  	kfree(wlc);
> -	wlc = NULL;
>  }
>  
>  static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 738cfac..a104d7a 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -445,18 +445,18 @@  static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
 	kfree(wlc->protection);
 	kfree(wlc->stf);
 	kfree(wlc->bandstate[0]);
-	kfree(wlc->corestate->macstat_snapshot);
+	if (wlc->corestate)
+		kfree(wlc->corestate->macstat_snapshot);
 	kfree(wlc->corestate);
-	kfree(wlc->hw->bandstate[0]);
+	if (wlc->hw)
+		kfree(wlc->hw->bandstate[0]);
 	kfree(wlc->hw);
 	if (wlc->beacon)
 		dev_kfree_skb_any(wlc->beacon);
 	if (wlc->probe_resp)
 		dev_kfree_skb_any(wlc->probe_resp);
 
-	/* free the wlc */
 	kfree(wlc);
-	wlc = NULL;
 }
 
 static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)