diff options
author | Rickard Strandqvist <rickard_strandqvist@spectrumdigital.se> | 2014-07-06 08:04:37 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2014-07-08 19:06:21 -0400 |
commit | 85b722d760f0de77c4bb371b77202784671f5a54 (patch) | |
tree | 182d0ebd035a918ecca3b952ad436bfa79543220 | |
parent | 29322d0db98e5a84f5cc6a55655bee3dc4ffb5ab (diff) |
isdn: hisax: l3ni1.c: Fix for possible null pointer dereference
There is otherwise a risk of a possible null pointer dereference.
Was largely found by using a static code analysis program called cppcheck.
Signed-off-by: Rickard Strandqvist <rickard_strandqvist@spectrumdigital.se>
-rw-r--r-- | drivers/isdn/hisax/l3ni1.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/drivers/isdn/hisax/l3ni1.c b/drivers/isdn/hisax/l3ni1.c index 0df6691d045c..8dc791bfaa6f 100644 --- a/drivers/isdn/hisax/l3ni1.c +++ b/drivers/isdn/hisax/l3ni1.c | |||
@@ -2059,13 +2059,17 @@ static int l3ni1_cmd_global(struct PStack *st, isdn_ctrl *ic) | |||
2059 | memcpy(p, ic->parm.ni1_io.data, ic->parm.ni1_io.datalen); /* copy data */ | 2059 | memcpy(p, ic->parm.ni1_io.data, ic->parm.ni1_io.datalen); /* copy data */ |
2060 | l = (p - temp) + ic->parm.ni1_io.datalen; /* total length */ | 2060 | l = (p - temp) + ic->parm.ni1_io.datalen; /* total length */ |
2061 | 2061 | ||
2062 | if (ic->parm.ni1_io.timeout > 0) | 2062 | if (ic->parm.ni1_io.timeout > 0) { |
2063 | if (!(pc = ni1_new_l3_process(st, -1))) | 2063 | pc = ni1_new_l3_process(st, -1); |
2064 | { free_invoke_id(st, id); | 2064 | if (!pc) { |
2065 | free_invoke_id(st, id); | ||
2065 | return (-2); | 2066 | return (-2); |
2066 | } | 2067 | } |
2067 | pc->prot.ni1.ll_id = ic->parm.ni1_io.ll_id; /* remember id */ | 2068 | /* remember id */ |
2068 | pc->prot.ni1.proc = ic->parm.ni1_io.proc; /* and procedure */ | 2069 | pc->prot.ni1.ll_id = ic->parm.ni1_io.ll_id; |
2070 | /* and procedure */ | ||
2071 | pc->prot.ni1.proc = ic->parm.ni1_io.proc; | ||
2072 | } | ||
2069 | 2073 | ||
2070 | if (!(skb = l3_alloc_skb(l))) | 2074 | if (!(skb = l3_alloc_skb(l))) |
2071 | { free_invoke_id(st, id); | 2075 | { free_invoke_id(st, id); |