From 53985dccb1c98b7af080e2314bff0c5024e781b0 Mon Sep 17 00:00:00 2001 From: Per Forlin Date: Sun, 17 Apr 2016 15:25:03 +0200 Subject: brcmf: Fix null pointer exception in bcdc_hdrpull In fwsignal.c: brcmf_fws_commit_skb() ... if (rc < 0) { entry->transit_count--; if (entry->suppressed) entry->suppr_transit_count--; (void)brcmf_proto_hdrpull(fws->drvr, false, skb, NULL); ^^^^^^^ goto rollback; } ... The call to hdrpull will trigger a null pointer exception unless a null check is made in the method implementation. Signed-off-by: Per Forlin Signed-off-by: Kalle Valo --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c') diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c index 288fe906c80e..d1bc51f92686 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c @@ -321,7 +321,8 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pub *drvr, bool do_fws, if (pktbuf->len == 0) return -ENODATA; - *ifp = tmp_if; + if (ifp != NULL) + *ifp = tmp_if; return 0; } -- cgit v1.2.3