* [patch] brcmsmac: NULL dereferences in brcms_c_detach_mfree()
@ 2014-11-28 9:43 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2014-11-28 9:43 UTC (permalink / raw)
To: Brett Rudley
Cc: Arend van Spriel, Franky (Zhenhui) Lin, Hante Meuleman,
John W. Linville, Julia Lawall, Pieter-Paul Giesberts,
Markus Elfring, Rafał Miłecki, linux-wireless,
brcm80211-dev-list, kernel-janitors
The brcms_c_attach_malloc() function can call this with a NULL
"wlc->corestate" or "wlc->hw".
Also I threw in a bonus cleanup by deleting an obvious comment and a
no-op NULL assignment. :)
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 738cfac..a104d7a 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -445,18 +445,18 @@ static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
kfree(wlc->protection);
kfree(wlc->stf);
kfree(wlc->bandstate[0]);
- kfree(wlc->corestate->macstat_snapshot);
+ if (wlc->corestate)
+ kfree(wlc->corestate->macstat_snapshot);
kfree(wlc->corestate);
- kfree(wlc->hw->bandstate[0]);
+ if (wlc->hw)
+ kfree(wlc->hw->bandstate[0]);
kfree(wlc->hw);
if (wlc->beacon)
dev_kfree_skb_any(wlc->beacon);
if (wlc->probe_resp)
dev_kfree_skb_any(wlc->probe_resp);
- /* free the wlc */
kfree(wlc);
- wlc = NULL;
}
static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [patch] brcmsmac: NULL dereferences in brcms_c_detach_mfree()
@ 2014-11-28 9:43 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2014-11-28 9:43 UTC (permalink / raw)
To: Brett Rudley
Cc: Arend van Spriel, Franky (Zhenhui) Lin, Hante Meuleman,
John W. Linville, Julia Lawall, Pieter-Paul Giesberts,
Markus Elfring, Rafał Miłecki, linux-wireless,
brcm80211-dev-list, kernel-janitors
The brcms_c_attach_malloc() function can call this with a NULL
"wlc->corestate" or "wlc->hw".
Also I threw in a bonus cleanup by deleting an obvious comment and a
no-op NULL assignment. :)
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 738cfac..a104d7a 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -445,18 +445,18 @@ static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
kfree(wlc->protection);
kfree(wlc->stf);
kfree(wlc->bandstate[0]);
- kfree(wlc->corestate->macstat_snapshot);
+ if (wlc->corestate)
+ kfree(wlc->corestate->macstat_snapshot);
kfree(wlc->corestate);
- kfree(wlc->hw->bandstate[0]);
+ if (wlc->hw)
+ kfree(wlc->hw->bandstate[0]);
kfree(wlc->hw);
if (wlc->beacon)
dev_kfree_skb_any(wlc->beacon);
if (wlc->probe_resp)
dev_kfree_skb_any(wlc->probe_resp);
- /* free the wlc */
kfree(wlc);
- wlc = NULL;
}
static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [patch] brcmsmac: NULL dereferences in brcms_c_detach_mfree()
2014-11-28 9:43 ` Dan Carpenter
@ 2014-11-28 10:08 ` Arend van Spriel
-1 siblings, 0 replies; 4+ messages in thread
From: Arend van Spriel @ 2014-11-28 10:08 UTC (permalink / raw)
To: Dan Carpenter, Brett Rudley
Cc: Franky (Zhenhui) Lin, Hante Meuleman, John W. Linville,
Julia Lawall, Pieter-Paul Giesberts, Markus Elfring,
Rafał Miłecki, linux-wireless, brcm80211-dev-list,
kernel-janitors
On 28-11-14 10:43, Dan Carpenter wrote:
> The brcms_c_attach_malloc() function can call this with a NULL
> "wlc->corestate" or "wlc->hw".
>
> Also I threw in a bonus cleanup by deleting an obvious comment and a
> no-op NULL assignment. :)
Thanks for the patch+bonus
Acked-by: Arend van Spriel <arend@broadcom.com>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
> index 738cfac..a104d7a 100644
> --- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
> +++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
> @@ -445,18 +445,18 @@ static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
> kfree(wlc->protection);
> kfree(wlc->stf);
> kfree(wlc->bandstate[0]);
> - kfree(wlc->corestate->macstat_snapshot);
> + if (wlc->corestate)
> + kfree(wlc->corestate->macstat_snapshot);
> kfree(wlc->corestate);
> - kfree(wlc->hw->bandstate[0]);
> + if (wlc->hw)
> + kfree(wlc->hw->bandstate[0]);
> kfree(wlc->hw);
> if (wlc->beacon)
> dev_kfree_skb_any(wlc->beacon);
> if (wlc->probe_resp)
> dev_kfree_skb_any(wlc->probe_resp);
>
> - /* free the wlc */
> kfree(wlc);
> - wlc = NULL;
> }
>
> static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [patch] brcmsmac: NULL dereferences in brcms_c_detach_mfree()
@ 2014-11-28 10:08 ` Arend van Spriel
0 siblings, 0 replies; 4+ messages in thread
From: Arend van Spriel @ 2014-11-28 10:08 UTC (permalink / raw)
To: Dan Carpenter, Brett Rudley
Cc: Franky (Zhenhui) Lin, Hante Meuleman, John W. Linville,
Julia Lawall, Pieter-Paul Giesberts, Markus Elfring,
Rafał Miłecki, linux-wireless, brcm80211-dev-list,
kernel-janitors
On 28-11-14 10:43, Dan Carpenter wrote:
> The brcms_c_attach_malloc() function can call this with a NULL
> "wlc->corestate" or "wlc->hw".
>
> Also I threw in a bonus cleanup by deleting an obvious comment and a
> no-op NULL assignment. :)
Thanks for the patch+bonus
Acked-by: Arend van Spriel <arend@broadcom.com>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
> index 738cfac..a104d7a 100644
> --- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
> +++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
> @@ -445,18 +445,18 @@ static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
> kfree(wlc->protection);
> kfree(wlc->stf);
> kfree(wlc->bandstate[0]);
> - kfree(wlc->corestate->macstat_snapshot);
> + if (wlc->corestate)
> + kfree(wlc->corestate->macstat_snapshot);
> kfree(wlc->corestate);
> - kfree(wlc->hw->bandstate[0]);
> + if (wlc->hw)
> + kfree(wlc->hw->bandstate[0]);
> kfree(wlc->hw);
> if (wlc->beacon)
> dev_kfree_skb_any(wlc->beacon);
> if (wlc->probe_resp)
> dev_kfree_skb_any(wlc->probe_resp);
>
> - /* free the wlc */
> kfree(wlc);
> - wlc = NULL;
> }
>
> static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-11-28 10:08 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-11-28 9:43 [patch] brcmsmac: NULL dereferences in brcms_c_detach_mfree() Dan Carpenter
2014-11-28 9:43 ` Dan Carpenter
2014-11-28 10:08 ` Arend van Spriel
2014-11-28 10:08 ` Arend van Spriel
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.