diff options
| author | Jia-Ju Bai <baijiaju1990@gmail.com> | 2019-07-29 11:56:52 +0200 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2019-09-03 15:37:22 +0200 |
| commit | b80df89f3909391623f89325595326519ff7da26 (patch) | |
| tree | 1da564d528345cef1054af16fec0f59057d4c577 /drivers/net/wireless | |
| parent | rtw88: pci: enable MSI interrupt (diff) | |
| download | linux-b80df89f3909391623f89325595326519ff7da26.tar.xz linux-b80df89f3909391623f89325595326519ff7da26.zip | |
brcm80211: Avoid possible null-pointer dereferences in wlc_phy_radio_init_2056()
In wlc_phy_radio_init_2056(), regs_SYN_2056_ptr, regs_TX_2056_ptr and
regs_RX_2056_ptr may be not assigned, and thus they are still NULL.
Then, they are used on lines 20042-20050:
wlc_phy_init_radio_regs(pi, regs_SYN_2056_ptr, (u16) RADIO_2056_SYN);
wlc_phy_init_radio_regs(pi, regs_TX_2056_ptr, (u16) RADIO_2056_TX0);
wlc_phy_init_radio_regs(pi, regs_TX_2056_ptr, (u16) RADIO_2056_TX1);
wlc_phy_init_radio_regs(pi, regs_RX_2056_ptr, (u16) RADIO_2056_RX0);
wlc_phy_init_radio_regs(pi, regs_RX_2056_ptr, (u16) RADIO_2056_RX1);
Thus, possible null-pointer dereferences may occur.
To avoid these bugs, when these variables are not assigned,
wlc_phy_radio_init_2056() directly returns.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless')
| -rw-r--r-- | drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c index 07f61d6155ea..0c57d48f47b1 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c @@ -20035,7 +20035,7 @@ static void wlc_phy_radio_init_2056(struct brcms_phy *pi) break; default: - break; + return; } } |