diff options
| author | Amitkumar Karwar <akarwar@marvell.com> | 2012-02-03 20:34:02 -0800 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2012-02-06 11:34:02 -0500 |
| commit | 2da8cbf8a6b454296c9db7b57cac72d5a39e3aa7 (patch) | |
| tree | 6c936d599c04ebf8e4979162de896c6017d64a48 | |
| parent | 07445f688218a48bde72316aed9de4fdcc173131 (diff) | |
| download | blackbird-op-linux-2da8cbf8a6b454296c9db7b57cac72d5a39e3aa7.tar.gz blackbird-op-linux-2da8cbf8a6b454296c9db7b57cac72d5a39e3aa7.zip | |
mwifiex: add NULL checks in driver unload path
If driver load is failed, sometimes few pointers may remain
uninitialized ex. priv->wdev, priv->netdev, adapter->sleep_cfm
This will cause NULL pointer dereferance while unloading the
driver.
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kiran Divekar <dkiran@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/mwifiex/init.c | 3 | ||||
| -rw-r--r-- | drivers/net/wireless/mwifiex/main.c | 12 |
2 files changed, 10 insertions, 5 deletions
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c index e05b417a3fae..1d0ec57a0143 100644 --- a/drivers/net/wireless/mwifiex/init.c +++ b/drivers/net/wireless/mwifiex/init.c @@ -382,7 +382,8 @@ mwifiex_free_adapter(struct mwifiex_adapter *adapter) adapter->if_ops.cleanup_if(adapter); - dev_kfree_skb_any(adapter->sleep_cfm); + if (adapter->sleep_cfm) + dev_kfree_skb_any(adapter->sleep_cfm); } /* diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c index 84be196188cc..b728f54451e4 100644 --- a/drivers/net/wireless/mwifiex/main.c +++ b/drivers/net/wireless/mwifiex/main.c @@ -822,7 +822,9 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem) continue; rtnl_lock(); - mwifiex_del_virtual_intf(priv->wdev->wiphy, priv->netdev); + if (priv->wdev && priv->netdev) + mwifiex_del_virtual_intf(priv->wdev->wiphy, + priv->netdev); rtnl_unlock(); } @@ -830,9 +832,11 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem) if (!priv) goto exit_remove; - wiphy_unregister(priv->wdev->wiphy); - wiphy_free(priv->wdev->wiphy); - kfree(priv->wdev); + if (priv->wdev) { + wiphy_unregister(priv->wdev->wiphy); + wiphy_free(priv->wdev->wiphy); + kfree(priv->wdev); + } mwifiex_terminate_workqueue(adapter); |
