aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFlorin Malita <fmalita@gmail.com>2006-05-23 01:35:30 -0400
committerLinus Torvalds <torvalds@g5.osdl.org>2006-05-23 13:35:32 -0400
commitbb6e093da23ace2724fdadd27738027468eb82b3 (patch)
tree6cbe07bc4a9ceeed0c35f5f15b5b5cd9f5dba319
parent30d6b2f3749e41ce37170ebc445948222b2db4ee (diff)
[PATCH] orinoco: possible null pointer dereference in orinoco_rx_monitor()
If the skb allocation fails, the current error path calls dev_kfree_skb_irq() with a NULL argument. Also, 'err' is not being used. Coverity CID: 275. Signed-off-by: Florin Malita <fmalita@gmail.com> Cc: "John W. Linville" <linville@tuxdriver.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
-rw-r--r--drivers/net/wireless/orinoco.c4
1 files changed, 1 insertions, 3 deletions
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
index 06523e2a8471..c2d0b09e0418 100644
--- a/drivers/net/wireless/orinoco.c
+++ b/drivers/net/wireless/orinoco.c
@@ -812,7 +812,6 @@ static void orinoco_rx_monitor(struct net_device *dev, u16 rxfid,
812 if (datalen > IEEE80211_DATA_LEN + 12) { 812 if (datalen > IEEE80211_DATA_LEN + 12) {
813 printk(KERN_DEBUG "%s: oversized monitor frame, " 813 printk(KERN_DEBUG "%s: oversized monitor frame, "
814 "data length = %d\n", dev->name, datalen); 814 "data length = %d\n", dev->name, datalen);
815 err = -EIO;
816 stats->rx_length_errors++; 815 stats->rx_length_errors++;
817 goto update_stats; 816 goto update_stats;
818 } 817 }
@@ -821,8 +820,7 @@ static void orinoco_rx_monitor(struct net_device *dev, u16 rxfid,
821 if (!skb) { 820 if (!skb) {
822 printk(KERN_WARNING "%s: Cannot allocate skb for monitor frame\n", 821 printk(KERN_WARNING "%s: Cannot allocate skb for monitor frame\n",
823 dev->name); 822 dev->name);
824 err = -ENOMEM; 823 goto update_stats;
825 goto drop;
826 } 824 }
827 825
828 /* Copy the 802.11 header to the skb */ 826 /* Copy the 802.11 header to the skb */