p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

brcmsmac: NULL dereferences in brcms_c_detach_mfree() 

The brcms_c_attach_malloc() function can call this with a NULL
"wlc->corestate" or "wlc->hw".

Also I threw in a bonus cleanup by deleting an obvious comment and a
no-op NULL assignment.  :)

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Dan Carpenter 2014-11-28 12:43:40 +03:00 committed by John W. Linville
parent dc50a52a36
commit c0fb754bd8
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/net/wireless/brcm80211/brcmsmac/main.c
View File

@ -445,18 +445,18 @@ static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
kfree(wlc->protection);
kfree(wlc->stf);
kfree(wlc->bandstate[0]);
kfree(wlc->corestate->macstat_snapshot);
if (wlc->corestate)
kfree(wlc->corestate->macstat_snapshot);
kfree(wlc->corestate);
kfree(wlc->hw->bandstate[0]);
if (wlc->hw)
kfree(wlc->hw->bandstate[0]);
kfree(wlc->hw);
if (wlc->beacon)
dev_kfree_skb_any(wlc->beacon);
if (wlc->probe_resp)
dev_kfree_skb_any(wlc->probe_resp);
/* free the wlc */
kfree(wlc);
wlc = NULL;
}
static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)