From: Arend van Spriel <arend@broadcom.com>
Date: Thu, 10 Feb 2011 11:03:45 +0000 (+0100)
Subject: staging: brcm80211: fix potential null pointer access handling ucode buffer
X-Git-Tag: firefly_0821_release~7613^2~2197^2~540
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=8746e2baaedd45b51ceb0adbcaf2ce52bbb83598;p=firefly-linux-kernel-4.4.55.git

staging: brcm80211: fix potential null pointer access handling ucode buffer

Allocation of buffer in function wl_ucode_init_buf can fail. This was
signalled by an error message, but code continued to access the null
pointer. This is now avoided by jumping to failure label.

Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Brett Rudley <brudley@broadcom.com>
Reviewed-by: Henry Ptasinski <henryp@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c b/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c
index c1d66995bdcb..304ae68b05b8 100644
--- a/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c
+++ b/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c
@@ -1707,6 +1707,7 @@ int wl_ucode_init_buf(struct wl_info *wl, void **pbuf, u32 idx)
 				if (*pbuf == NULL) {
 					WL_ERROR("fail to alloc %d bytes\n",
 						 hdr->len);
+					goto fail;
 				}
 				bcopy(pdata, *pbuf, hdr->len);
 				return 0;
@@ -1715,6 +1716,7 @@ int wl_ucode_init_buf(struct wl_info *wl, void **pbuf, u32 idx)
 	}
 	WL_ERROR("ERROR: ucode buf tag:%d can not be found!\n", idx);
 	*pbuf = NULL;
+fail:
 	return -1;
 }