Skip to contentSkip to conversation

ath9k_htc: dereferencing before check in hif_usb_tx_cb()

PATCH New Dan Carpenter 2 participants 2 messages May 14, 2010 – May 18, 2010 Qualcomm Atheros ATH9K wireless driver

lore
Share & tools
lore
#0 lore raw

PATCH 1/2 ath9k_htc: dereferencing before check in hif_usb_tx_cb()

After c11d8f89d3b7: "ath9k_htc: Simplify TX URB management" we no longer assume that tx_buf is a non-null pointer.

drivers/net/wireless/ath/ath9k/hif_usb.c +4 -2
index 46dc41a..ac82911 100644
@@ -107,12 +107,14 @@ static inline void ath9k_skb_queue_purge(struct hif_device_usb *hif_dev,
 static void hif_usb_tx_cb(struct urb *urb)
 {
 	struct tx_buf *tx_buf = (struct tx_buf *) urb->context;
-	struct hif_device_usb *hif_dev = tx_buf->hif_dev;
+	struct hif_device_usb *hif_dev;
 	struct sk_buff *skb;
 
-	if (!hif_dev || !tx_buf)
+	if (!tx_buf || !tx_buf->hif_dev)
 		return;
 
+	hif_dev = tx_buf->hif_dev;
+
 	switch (urb->status) {
 	case 0:
 		break;
#1 lore raw

PATCH 1/2 ath9k_htc: dereferencing before check in hif_usb_tx_cb()

Quoted 4 lines · Dan Carpenter

After c11d8f89d3b7: "ath9k_htc: Simplify TX URB management" we no longer assume that tx_buf is a non-null pointer.

Thanks.

Quoted 21 lines
drivers/net/wireless/ath/ath9k/hif_usb.c +4 -2
index 46dc41a..ac82911 100644
@@ -107,12 +107,14 @@ static inline void ath9k_skb_queue_purge(struct hif_device_usb *hif_dev,
 static void hif_usb_tx_cb(struct urb *urb)
 {
 	struct tx_buf *tx_buf = (struct tx_buf *) urb->context;
-	struct hif_device_usb *hif_dev = tx_buf->hif_dev;
+	struct hif_device_usb *hif_dev;
 	struct sk_buff *skb;
 
-	if (!hif_dev || !tx_buf)
+	if (!tx_buf || !tx_buf->hif_dev)
 		return;
 
+	hif_dev = tx_buf->hif_dev;
+
 	switch (urb->status) {
 	case 0:
 		break;