staging: brcm80211: fix potential null pointer access handling ucode buffer
authorArend van Spriel <arend@broadcom.com>
Thu, 10 Feb 2011 11:03:45 +0000 (12:03 +0100)
committerGreg Kroah-Hartman <gregkh@suse.de>
Fri, 18 Feb 2011 20:48:03 +0000 (12:48 -0800)
Allocation of buffer in function wl_ucode_init_buf can fail. This was
signalled by an error message, but code continued to access the null
pointer. This is now avoided by jumping to failure label.

Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Brett Rudley <brudley@broadcom.com>
Reviewed-by: Henry Ptasinski <henryp@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/staging/brcm80211/brcmsmac/wl_mac80211.c

index c1d66995bdcbbac7b77d777c18fc810dcbf36d01..304ae68b05b8a61ae43431407cadbd677315bfb5 100644 (file)
@@ -1707,6 +1707,7 @@ int wl_ucode_init_buf(struct wl_info *wl, void **pbuf, u32 idx)
                                if (*pbuf == NULL) {
                                        WL_ERROR("fail to alloc %d bytes\n",
                                                 hdr->len);
+                                       goto fail;
                                }
                                bcopy(pdata, *pbuf, hdr->len);
                                return 0;
@@ -1715,6 +1716,7 @@ int wl_ucode_init_buf(struct wl_info *wl, void **pbuf, u32 idx)
        }
        WL_ERROR("ERROR: ucode buf tag:%d can not be found!\n", idx);
        *pbuf = NULL;
+fail:
        return -1;
 }