mwifiex: fix null derefs, mem leaks and trivia

This patch:
 - adds kfree() where necessary
 - prevents potential null dereferences
 - makes use of kfree_skb()
 - replaces -1 for failed kzallocs with -ENOMEM

Signed-off-by: Christoph Fritz <chf.fritz@googlemail.com>
Reviewed-by: Kiran Divekar <dkiran@marvell.com>
Tested-by: Amitkumar Karwar <akarwar@marvell.com>
Acked-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 4 insertions, 2 deletions

diff --git a/drivers/net/wireless/mwifiex/11n_aggr.c b/drivers/net/wireless/mwifiex/11n_aggr.c
index 12cf4246f96b..2b2cca5e6d0f 100644
--- a/drivers/net/wireless/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/mwifiex/11n_aggr.c
@@ -318,7 +318,8 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
                 else
                         skb_src = NULL;
 
-                pra_list->total_pkts_size -= skb_src->len;
+                if (skb_src)
+                        pra_list->total_pkts_size -= skb_src->len;
 
                 spin_unlock_irqrestore(&priv->wmm.ra_list_spinlock,
                                        ra_list_flags);
@@ -373,7 +374,8 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
                         (adapter->pps_uapsd_mode) &&
                         (adapter->tx_lock_flag)) {
                                 priv->adapter->tx_lock_flag = false;
-                                ptx_pd->flags = 0;
+                                if (ptx_pd)
+                                        ptx_pd->flags = 0;
                 }
 
                 skb_queue_tail(&pra_list->skb_head, skb_aggr);