diff options
| author | Dan Carpenter <error27@gmail.com> | 2010-07-15 10:23:10 +0200 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2010-07-16 14:03:42 -0400 |
| commit | 48d5548fc5e5ad79ca98a287b67f403834929739 (patch) | |
| tree | 728303cb63471478d6bb0c0a11ac62b6ed15ec69 /drivers/net/wireless/orinoco/orinoco_usb.c | |
| parent | 9171acc7e094b3ca88e624f39891a4f3bf9d083c (diff) | |
| download | linux-48d5548fc5e5ad79ca98a287b67f403834929739.tar.gz linux-48d5548fc5e5ad79ca98a287b67f403834929739.tar.bz2 linux-48d5548fc5e5ad79ca98a287b67f403834929739.zip | |
orinoco_usb: potential null dereference
Smatch complains that "upriv->read_urb" gets dereferenced before
checking for NULL. It turns out that it's possible for
"upriv->read_urb" to be NULL so I added checks around the dereferences.
Also I remove an "if (upriv->bap_buf != NULL)" check because
"kfree(NULL) is OK.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/orinoco/orinoco_usb.c')
| -rw-r--r-- | drivers/net/wireless/orinoco/orinoco_usb.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/drivers/net/wireless/orinoco/orinoco_usb.c b/drivers/net/wireless/orinoco/orinoco_usb.c index 020da76c9558..b7864001e7e1 100644 --- a/drivers/net/wireless/orinoco/orinoco_usb.c +++ b/drivers/net/wireless/orinoco/orinoco_usb.c @@ -1502,16 +1502,16 @@ static inline void ezusb_delete(struct ezusb_priv *upriv) ezusb_ctx_complete(list_entry(item, struct request_context, list)); - if (upriv->read_urb->status == -EINPROGRESS) + if (upriv->read_urb && upriv->read_urb->status == -EINPROGRESS) printk(KERN_ERR PFX "Some URB in progress\n"); mutex_unlock(&upriv->mtx); - kfree(upriv->read_urb->transfer_buffer); - if (upriv->bap_buf != NULL) - kfree(upriv->bap_buf); - if (upriv->read_urb != NULL) + if (upriv->read_urb) { + kfree(upriv->read_urb->transfer_buffer); usb_free_urb(upriv->read_urb); + } + kfree(upriv->bap_buf); if (upriv->dev) { struct orinoco_private *priv = ndev_priv(upriv->dev); orinoco_if_del(priv); |