diff options
| author | Ajay Singh <ajay.kathat@microchip.com> | 2018-12-15 02:32:29 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-12-17 14:24:06 +0100 |
| commit | 0b7b9b6c3dee8232c7c6dd2a5a56100e20576717 (patch) | |
| tree | 9b0ba9c5b71e21b690fcfaf3318c31f4f59dd1a2 /drivers/staging | |
| parent | 2da56630b1cc422f58408033102b8f91ae97bc91 (diff) | |
staging: wilc1000: fix NULL dereference inside wilc_scan()
Added NULL check before accessing 'hidden_net' pointer inside
wilc_scan() to fix the issue found by static code checker.
Fixes: 8f1a0ac1eba7 ("staging: wilc1000: handle scan operation callback from cfg80211 context")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging')
| -rw-r--r-- | drivers/staging/wilc1000/host_interface.c | 48 |
1 files changed, 26 insertions, 22 deletions
diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/host_interface.c index b8603f2f777b..70c854d939ce 100644 --- a/drivers/staging/wilc1000/host_interface.c +++ b/drivers/staging/wilc1000/host_interface.c @@ -246,27 +246,29 @@ int wilc_scan(struct wilc_vif *vif, u8 scan_source, u8 scan_type, hif_drv->usr_scan_req.ch_cnt = 0; - wid_list[index].id = WID_SSID_PROBE_REQ; - wid_list[index].type = WID_STR; - - for (i = 0; i < hidden_net->n_ssids; i++) - valuesize += ((hidden_net->net_info[i].ssid_len) + 1); - hdn_ntwk_wid_val = kmalloc(valuesize + 1, GFP_KERNEL); - wid_list[index].val = hdn_ntwk_wid_val; - if (wid_list[index].val) { - buffer = wid_list[index].val; - - *buffer++ = hidden_net->n_ssids; - - for (i = 0; i < hidden_net->n_ssids; i++) { - *buffer++ = hidden_net->net_info[i].ssid_len; - memcpy(buffer, hidden_net->net_info[i].ssid, - hidden_net->net_info[i].ssid_len); - buffer += hidden_net->net_info[i].ssid_len; - } + if (hidden_net) { + wid_list[index].id = WID_SSID_PROBE_REQ; + wid_list[index].type = WID_STR; + + for (i = 0; i < hidden_net->n_ssids; i++) + valuesize += ((hidden_net->net_info[i].ssid_len) + 1); + hdn_ntwk_wid_val = kmalloc(valuesize + 1, GFP_KERNEL); + wid_list[index].val = hdn_ntwk_wid_val; + if (wid_list[index].val) { + buffer = wid_list[index].val; + + *buffer++ = hidden_net->n_ssids; + + for (i = 0; i < hidden_net->n_ssids; i++) { + *buffer++ = hidden_net->net_info[i].ssid_len; + memcpy(buffer, hidden_net->net_info[i].ssid, + hidden_net->net_info[i].ssid_len); + buffer += hidden_net->net_info[i].ssid_len; + } - wid_list[index].size = (s32)(valuesize + 1); - index++; + wid_list[index].size = (s32)(valuesize + 1); + index++; + } } wid_list[index].id = WID_INFO_ELEMENT_PROBE; @@ -316,8 +318,10 @@ int wilc_scan(struct wilc_vif *vif, u8 scan_source, u8 scan_type, jiffies + msecs_to_jiffies(HOST_IF_SCAN_TIMEOUT)); error: - kfree(hidden_net->net_info); - kfree(hdn_ntwk_wid_val); + if (hidden_net) { + kfree(hidden_net->net_info); + kfree(hdn_ntwk_wid_val); + } return result; } |