diff options
| author | Per Forlin <per.forlin@gmail.com> | 2016-04-17 15:25:03 +0200 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2016-04-26 12:18:37 +0300 |
| commit | 53985dccb1c98b7af080e2314bff0c5024e781b0 (patch) | |
| tree | 38cfe040a910bb1f9118d2dceddd651d2184e000 /drivers/net/wireless/broadcom | |
| parent | 7705ba6f7badb8cf38a0a19dad71e11a77ecb9cd (diff) | |
| download | linux-53985dccb1c98b7af080e2314bff0c5024e781b0.tar.gz linux-53985dccb1c98b7af080e2314bff0c5024e781b0.tar.bz2 linux-53985dccb1c98b7af080e2314bff0c5024e781b0.zip | |
brcmf: Fix null pointer exception in bcdc_hdrpull
In fwsignal.c: brcmf_fws_commit_skb()
...
if (rc < 0) {
entry->transit_count--;
if (entry->suppressed)
entry->suppr_transit_count--;
(void)brcmf_proto_hdrpull(fws->drvr, false, skb, NULL);
^^^^^^^
goto rollback;
}
...
The call to hdrpull will trigger a null pointer exception
unless a null check is made in the method implementation.
Signed-off-by: Per Forlin <per.forlin@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/broadcom')
| -rw-r--r-- | drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c index 288fe906c80e..d1bc51f92686 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c @@ -321,7 +321,8 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pub *drvr, bool do_fws, if (pktbuf->len == 0) return -ENODATA; - *ifp = tmp_if; + if (ifp != NULL) + *ifp = tmp_if; return 0; } |