Re: [patch] brcmsmac: NULL dereferences in brcms_c_detach_mfree()

[Arend van Spriel <arend@broadcom.com>]

On 28-11-14 10:43, Dan Carpenter wrote:
> The brcms_c_attach_malloc() function can call this with a NULL
> "wlc->corestate" or "wlc->hw".
> 
> Also I threw in a bonus cleanup by deleting an obvious comment and a
> no-op NULL assignment.  :)

Thanks for the patch+bonus

Acked-by: Arend van Spriel <arend@broadcom.com>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
> index 738cfac..a104d7a 100644
> --- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
> +++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
> @@ -445,18 +445,18 @@ static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
>  	kfree(wlc->protection);
>  	kfree(wlc->stf);
>  	kfree(wlc->bandstate[0]);
> -	kfree(wlc->corestate->macstat_snapshot);
> +	if (wlc->corestate)
> +		kfree(wlc->corestate->macstat_snapshot);
>  	kfree(wlc->corestate);
> -	kfree(wlc->hw->bandstate[0]);
> +	if (wlc->hw)
> +		kfree(wlc->hw->bandstate[0]);
>  	kfree(wlc->hw);
>  	if (wlc->beacon)
>  		dev_kfree_skb_any(wlc->beacon);
>  	if (wlc->probe_resp)
>  		dev_kfree_skb_any(wlc->probe_resp);
>  
> -	/* free the wlc */
>  	kfree(wlc);
> -	wlc = NULL;
>  }
>  
>  static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)
>