2007-07-19 13:59:31

by Eugene Teo

Subject: [PATCH] drivers/net/wireless/libertas/cmd.c: fix adapter->driver_lock dereference

adapter is NULL if cmdnode is not.

Signed-off-by: Eugene Teo <[email protected]>
---
drivers/net/wireless/libertas/cmd.c | 10 +---------
1 files changed, 1 insertions(+), 9 deletions(-)

diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 4a8f5dc..03af8bb 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -941,7 +941,7 @@ static int DownloadcommandToStation(wlan_private * priv,
unsigned long flags;
struct cmd_ds_command *cmdptr;
wlan_adapter *adapter = priv->adapter;
- int ret = 0;
+ int ret = -1;
u16 cmdsize;
u16 command;

@@ -950,12 +950,6 @@ static int DownloadcommandToStation(wlan_private * priv,
if (!adapter || !cmdnode) {
lbs_deb_cmd("DNLD_CMD: adapter = %p, cmdnode = %p\n",
adapter, cmdnode);
- if (cmdnode) {
- spin_lock_irqsave(&adapter->driver_lock, flags);
- __libertas_cleanup_and_insert_cmd(priv, cmdnode);
- spin_unlock_irqrestore(&adapter->driver_lock, flags);
- }
- ret = -1;
goto done;
}

@@ -968,7 +962,6 @@ static int DownloadcommandToStation(wlan_private * priv,
"Not sending\n");
__libertas_cleanup_and_insert_cmd(priv, cmdnode);
spin_unlock_irqrestore(&adapter->driver_lock, flags);
- ret = -1;
goto done;
}

@@ -993,7 +986,6 @@ static int DownloadcommandToStation(wlan_private * priv,
__libertas_cleanup_and_insert_cmd(priv, adapter->cur_cmd);
adapter->cur_cmd = NULL;
spin_unlock_irqrestore(&adapter->driver_lock, flags);
- ret = -1;
goto done;
}

--
1.5.2.2

2007-07-19 20:10:09

by Dan Williams

Subject: Re: [PATCH] drivers/net/wireless/libertas/cmd.c: fix adapter->driver_lock dereference

On Thu, 2007-07-19 at 21:59 +0800, Eugene Teo wrote:
> adapter is NULL if cmdnode is not.

Applied, thanks!

Dan

> Signed-off-by: Eugene Teo <[email protected]>
> ---
> drivers/net/wireless/libertas/cmd.c | 10 +---------
> 1 files changed, 1 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
> index 4a8f5dc..03af8bb 100644
> --- a/drivers/net/wireless/libertas/cmd.c
> +++ b/drivers/net/wireless/libertas/cmd.c
> @@ -941,7 +941,7 @@ static int DownloadcommandToStation(wlan_private * priv,
> unsigned long flags;
> struct cmd_ds_command *cmdptr;
> wlan_adapter *adapter = priv->adapter;
> - int ret = 0;
> + int ret = -1;
> u16 cmdsize;
> u16 command;
>
> @@ -950,12 +950,6 @@ static int DownloadcommandToStation(wlan_private * priv,
> if (!adapter || !cmdnode) {
> lbs_deb_cmd("DNLD_CMD: adapter = %p, cmdnode = %p\n",
> adapter, cmdnode);
> - if (cmdnode) {
> - spin_lock_irqsave(&adapter->driver_lock, flags);
> - __libertas_cleanup_and_insert_cmd(priv, cmdnode);
> - spin_unlock_irqrestore(&adapter->driver_lock, flags);
> - }
> - ret = -1;
> goto done;
> }
>
> @@ -968,7 +962,6 @@ static int DownloadcommandToStation(wlan_private * priv,
> "Not sending\n");
> __libertas_cleanup_and_insert_cmd(priv, cmdnode);
> spin_unlock_irqrestore(&adapter->driver_lock, flags);
> - ret = -1;
> goto done;
> }
>
> @@ -993,7 +986,6 @@ static int DownloadcommandToStation(wlan_private * priv,
> __libertas_cleanup_and_insert_cmd(priv, adapter->cur_cmd);
> adapter->cur_cmd = NULL;
> spin_unlock_irqrestore(&adapter->driver_lock, flags);
> - ret = -1;
> goto done;
> }
>