From patchwork Tue Nov 6 00:22:21 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Franky Lin X-Patchwork-Id: 1702251 Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork1.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork1.kernel.org (Postfix) with ESMTP id 2C2D23FCA5 for ; Tue, 6 Nov 2012 00:23:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753882Ab2KFAXB (ORCPT ); Mon, 5 Nov 2012 19:23:01 -0500 Received: from mms2.broadcom.com ([216.31.210.18]:4925 "EHLO mms2.broadcom.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754128Ab2KFAWu (ORCPT ); Mon, 5 Nov 2012 19:22:50 -0500 Received: from [10.9.200.133] by mms2.broadcom.com with ESMTP (Broadcom SMTP Relay (Email Firewall v6.5)); Mon, 05 Nov 2012 16:20:40 -0800 X-Server-Uuid: 4500596E-606A-40F9-852D-14843D8201B2 Received: from mail-irva-13.broadcom.com (10.11.16.103) by IRVEXCHHUB02.corp.ad.broadcom.com (10.9.200.133) with Microsoft SMTP Server id 8.2.247.2; Mon, 5 Nov 2012 16:22:12 -0800 Received: from mail-sj1-12.sj.broadcom.com (mail-sj1-12.sj.broadcom.com [10.17.16.106]) by mail-irva-13.broadcom.com (Postfix) with ESMTP id 639EB40FF0; Mon, 5 Nov 2012 16:22:39 -0800 (PST) Received: from lc-sj1-3560.broadcom.com (lc-sj1-3560.sj.broadcom.com [10.17.194.250]) by mail-sj1-12.sj.broadcom.com (Postfix) with ESMTP id 40192207E2; Mon, 5 Nov 2012 16:22:34 -0800 (PST) Received: by lc-sj1-3560.broadcom.com (Postfix, from userid 25250) id 5ED1E158A5B8; Mon, 5 Nov 2012 16:22:32 -0800 (PST) From: "Franky Lin" To: linville@tuxdriver.com cc: linux-wireless@vger.kernel.org, "Arend van Spriel" Subject: [PATCH 13/24] brcmfmac: fix NULL pointer access in brcmf_create_iovar() Date: Mon, 5 Nov 2012 16:22:21 -0800 Message-ID: <1352161352-30405-14-git-send-email-frankyl@broadcom.com> X-Mailer: git-send-email 1.7.6 In-Reply-To: <1352161352-30405-1-git-send-email-frankyl@broadcom.com> References: <1352161352-30405-1-git-send-email-frankyl@broadcom.com> MIME-Version: 1.0 X-WSS-ID: 7C8688523QC6407756-02-01 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Arend van Spriel The function brcmf_fil_bsscfg_data_get() calls brcmf_create_iovar() with data pointer set to NULL, which caused a NULL pointer access. As it should be possible to provide data in message towards the firmware, it should just pass the data buffer instead. Reviewed-by: Hante Meuleman Signed-off-by: Arend van Spriel Signed-off-by: Franky Lin --- drivers/net/wireless/brcm80211/brcmfmac/fwil.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil.c b/drivers/net/wireless/brcm80211/brcmfmac/fwil.c index 4b272c3..f121d41 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/fwil.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil.c @@ -294,7 +294,7 @@ brcmf_fil_bsscfg_data_get(struct brcmf_if *ifp, char *name, mutex_lock(&drvr->proto_block); - buflen = brcmf_create_bsscfg(ifp->bssidx, name, NULL, len, + buflen = brcmf_create_bsscfg(ifp->bssidx, name, data, len, drvr->proto_buf, sizeof(drvr->proto_buf)); if (buflen) { err = brcmf_fil_cmd_data(ifp, BRCMF_C_GET_VAR, drvr->proto_buf,