Commit 8746e2ba authored by Arend van Spriel's avatar Arend van Spriel Committed by Greg Kroah-Hartman

staging: brcm80211: fix potential null pointer access handling ucode buffer

Allocation of buffer in function wl_ucode_init_buf can fail. This was
signalled by an error message, but code continued to access the null
pointer. This is now avoided by jumping to failure label.
Reviewed-by: default avatarRoland Vossen <rvossen@broadcom.com>
Reviewed-by: default avatarBrett Rudley <brudley@broadcom.com>
Reviewed-by: default avatarHenry Ptasinski <henryp@broadcom.com>
Signed-off-by: default avatarArend van Spriel <arend@broadcom.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 0bef7748
...@@ -1707,6 +1707,7 @@ int wl_ucode_init_buf(struct wl_info *wl, void **pbuf, u32 idx) ...@@ -1707,6 +1707,7 @@ int wl_ucode_init_buf(struct wl_info *wl, void **pbuf, u32 idx)
if (*pbuf == NULL) { if (*pbuf == NULL) {
WL_ERROR("fail to alloc %d bytes\n", WL_ERROR("fail to alloc %d bytes\n",
hdr->len); hdr->len);
goto fail;
} }
bcopy(pdata, *pbuf, hdr->len); bcopy(pdata, *pbuf, hdr->len);
return 0; return 0;
...@@ -1715,6 +1716,7 @@ int wl_ucode_init_buf(struct wl_info *wl, void **pbuf, u32 idx) ...@@ -1715,6 +1716,7 @@ int wl_ucode_init_buf(struct wl_info *wl, void **pbuf, u32 idx)
} }
WL_ERROR("ERROR: ucode buf tag:%d can not be found!\n", idx); WL_ERROR("ERROR: ucode buf tag:%d can not be found!\n", idx);
*pbuf = NULL; *pbuf = NULL;
fail:
return -1; return -1;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment