brcmsmac: NULL dereferences in brcms_c_detach_mfree()

The brcms_c_attach_malloc() function can call this with a NULL
"wlc->corestate" or "wlc->hw".

Also I threw in a bonus cleanup by deleting an obvious comment and a
no-op NULL assignment.  :)

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 738cfaca1e0f525a06cc0fd8f1f047f44f24dbce..a104d7ac3796491a62274f1bcf7399d15d046a22 100644 (file)
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -445,18 +445,18 @@ static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
        kfree(wlc->protection);
        kfree(wlc->stf);
        kfree(wlc->bandstate[0]);
-       kfree(wlc->corestate->macstat_snapshot);
+       if (wlc->corestate)
+               kfree(wlc->corestate->macstat_snapshot);
        kfree(wlc->corestate);
-       kfree(wlc->hw->bandstate[0]);
+       if (wlc->hw)
+               kfree(wlc->hw->bandstate[0]);
        kfree(wlc->hw);
        if (wlc->beacon)
                dev_kfree_skb_any(wlc->beacon);
        if (wlc->probe_resp)
                dev_kfree_skb_any(wlc->probe_resp);
 
-       /* free the wlc */
        kfree(wlc);
-       wlc = NULL;
 }
 
 static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)