brcmfmac: move dereference under check for NULL

PATCH In review Dan Carpenter 2 participants 2 messages Jun 6, 2013

Subsystems (2)

Kernel janitors Networking drivers (wireless)

lore

Share & tools

lore

Dan Carpenter

author

2013-06-06 10:55 UTC #0 lore raw

PATCH 1/1 brcmfmac: move dereference under check for NULL

skb_pull() dereferences the skb parameter.

Signed-off-by Dan Carpenter <[email protected]>

drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c +1 -1

index ea37bd4..c35296f 100644
@@ -861,9 +861,9 @@ static bool brcmf_fws_tim_update(struct brcmf_fws_info *fws,
 		      BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN + 2 +
 		      4 + fws->drvr->hdrlen;
 		skb = brcmu_pkt_buf_get_skb(len);
-		skb_pull(skb, len);
 		if (skb = NULL)
 			return false;
+		skb_pull(skb, len);
 		skcb = brcmf_skbcb(skb);
 		skcb->mac = entry;
 		skcb->state = BRCMF_FWS_SKBSTATE_TIM;

Arend van Spriel

2013-06-06 11:46 UTC #1 lore raw

Quoted 3 lines · Dan Carpenter

skb_pull() dereferences the skb parameter.
Signed-off-by Dan Carpenter <[email protected]>

Hi Dan,

Just missed that. This code fragment was resubmitted just minutes ago. I will rework the patch to incorporate this change.

Regards,
Arend

Quoted 16 lines

drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c +1 -1

index ea37bd4..c35296f 100644
@@ -861,9 +861,9 @@ static bool brcmf_fws_tim_update(struct brcmf_fws_info *fws,
  		      BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN + 2 +
  		      4 + fws->drvr->hdrlen;
  		skb = brcmu_pkt_buf_get_skb(len);
-		skb_pull(skb, len);
  		if (skb = NULL)
  			return false;
+		skb_pull(skb, len);
  		skcb = brcmf_skbcb(skb);
  		skcb->mac = entry;
  		skcb->state = BRCMF_FWS_SKBSTATE_TIM;