diff mbox series

brcmfmac: check ndev pointer

Message ID 20200802161804.6126-1-trix@redhat.com (mailing list archive)
State Accepted
Commit 9c9f015bc9f8839831c7ba0a6d731a3853c464e2
Delegated to: Kalle Valo
Headers show
Series brcmfmac: check ndev pointer | expand

Commit Message

Tom Rix Aug. 2, 2020, 4:18 p.m. UTC 
From: Tom Rix <trix@redhat.com>

Clang static analysis reports this error

brcmfmac/core.c:490:4: warning: Dereference of null pointer
        (*ifp)->ndev->stats.rx_errors++;
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In this block of code

	if (ret || !(*ifp) || !(*ifp)->ndev) {
		if (ret != -ENODATA && *ifp)
			(*ifp)->ndev->stats.rx_errors++;
		brcmu_pkt_buf_free_skb(skb);
		return -ENODATA;
	}

(*ifp)->ndev being NULL is caught as an error
But then it is used to report the error.

So add a check before using it.

Fixes: 91b632803ee4 ("brcmfmac: Use net_device_stats from struct net_device")

Signed-off-by: Tom Rix <trix@redhat.com>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Kalle Valo Aug. 18, 2020, 12:50 p.m. UTC | #1 
trix@redhat.com wrote:

> From: Tom Rix <trix@redhat.com>
> 
> Clang static analysis reports this error
> 
> brcmfmac/core.c:490:4: warning: Dereference of null pointer
>         (*ifp)->ndev->stats.rx_errors++;
>         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 
> In this block of code
> 
> 	if (ret || !(*ifp) || !(*ifp)->ndev) {
> 		if (ret != -ENODATA && *ifp)
> 			(*ifp)->ndev->stats.rx_errors++;
> 		brcmu_pkt_buf_free_skb(skb);
> 		return -ENODATA;
> 	}
> 
> (*ifp)->ndev being NULL is caught as an error
> But then it is used to report the error.
> 
> So add a check before using it.
> 
> Fixes: 91b632803ee4 ("brcmfmac: Use net_device_stats from struct net_device")
> Signed-off-by: Tom Rix <trix@redhat.com>

Patch applied to wireless-drivers-next.git, thanks.

9c9f015bc9f8 brcmfmac: check ndev pointer
diff mbox series

Patch

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index f89010a81ffb..aa9ced3c86fb 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -486,7 +486,7 @@  static int brcmf_rx_hdrpull(struct brcmf_pub *drvr, struct sk_buff *skb,
 	ret = brcmf_proto_hdrpull(drvr, true, skb, ifp);
 
 	if (ret || !(*ifp) || !(*ifp)->ndev) {
-		if (ret != -ENODATA && *ifp)
+		if (ret != -ENODATA && *ifp && (*ifp)->ndev)
 			(*ifp)->ndev->stats.rx_errors++;
 		brcmu_pkt_buf_free_skb(skb);
 		return -ENODATA;