CHROMIUM: mwifiex: Dereference bss only if it is non-null

[cascardo/linux.git] / drivers / net / wireless / mwifiex / sta_ioctl.c

diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 252d8fa..1474a02 100644 (file)
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -56,7 +56,6 @@ int mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
  */
 int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter)
 {
-       bool cancel_flag = false;
        int status;
        struct cmd_ctrl_node *cmd_queued;
 
@@ -70,14 +69,11 @@ int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter)
        atomic_inc(&adapter->cmd_pending);
 
        /* Wait for completion */
-       wait_event_interruptible(adapter->cmd_wait_q.wait,
-                                *(cmd_queued->condition));
-       if (!*(cmd_queued->condition))
-               cancel_flag = true;
-
-       if (cancel_flag) {
-               mwifiex_cancel_pending_ioctl(adapter);
-               dev_dbg(adapter->dev, "cmd cancel\n");
+       status = wait_event_interruptible(adapter->cmd_wait_q.wait,
+                                         *(cmd_queued->condition));
+       if (status) {
+               dev_err(adapter->dev, "cmd_wait_q terminated: %d\n", status);
+               return status;
        }
 
        status = adapter->cmd_wait_q.status;
@@ -156,23 +152,15 @@ int mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
  */
 int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
                              struct cfg80211_bss *bss,
-                             struct mwifiex_bssdescriptor *bss_desc)
+                             struct mwifiex_bssdescriptor *bss_desc,
+                             u8 *beacon_ie, size_t beacon_ie_len)
 {
-       int ret;
-       u8 *beacon_ie;
        struct mwifiex_bss_priv *bss_priv = (void *)bss->priv;
 
-       beacon_ie = kmemdup(bss->information_elements, bss->len_beacon_ies,
-                           GFP_KERNEL);
-       if (!beacon_ie) {
-               dev_err(priv->adapter->dev, " failed to alloc beacon_ie\n");
-               return -ENOMEM;
-       }
-
        memcpy(bss_desc->mac_address, bss->bssid, ETH_ALEN);
        bss_desc->rssi = bss->signal;
        bss_desc->beacon_buf = beacon_ie;
-       bss_desc->beacon_buf_size = bss->len_beacon_ies;
+       bss_desc->beacon_buf_size = beacon_ie_len;
        bss_desc->beacon_period = bss->beacon_interval;
        bss_desc->cap_info_bitmap = bss->capability;
        bss_desc->bss_band = bss_priv->band;
@@ -189,10 +177,7 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
        else
                bss_desc->bss_mode = NL80211_IFTYPE_STATION;
 
-       ret = mwifiex_update_bss_desc_with_ie(priv->adapter, bss_desc);
-
-       kfree(beacon_ie);
-       return ret;
+       return mwifiex_update_bss_desc_with_ie(priv->adapter, bss_desc);
 }
 
 static int mwifiex_process_country_ie(struct mwifiex_private *priv,
@@ -244,6 +229,8 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
        int ret;
        struct mwifiex_adapter *adapter = priv->adapter;
        struct mwifiex_bssdescriptor *bss_desc = NULL;
+       u8 *beacon_ie = NULL;
+       size_t beacon_ie_len;
 
        priv->scan_block = false;
 
@@ -258,7 +245,16 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                        return -ENOMEM;
                }
 
-               ret = mwifiex_fill_new_bss_desc(priv, bss, bss_desc);
+               beacon_ie_len = bss->len_information_elements;
+               beacon_ie = kmemdup(bss->information_elements, beacon_ie_len,
+                                   GFP_KERNEL);
+               if (!beacon_ie) {
+                       kfree(bss_desc);
+                       return -ENOMEM;
+               }
+
+               ret = mwifiex_fill_new_bss_desc(priv, bss, bss_desc, beacon_ie,
+                                               beacon_ie_len);
                if (ret)
                        goto done;
        }
@@ -276,8 +272,7 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                dev_dbg(adapter->dev, "info: SSID found in scan list ... "
                                      "associating...\n");
 
-               if (!netif_queue_stopped(priv->netdev))
-                       mwifiex_stop_net_dev_queue(priv->netdev, adapter);
+               mwifiex_stop_net_dev_queue(priv->netdev, adapter);
                if (netif_carrier_ok(priv->netdev))
                        netif_carrier_off(priv->netdev);
 
@@ -304,8 +299,8 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                if (bss_desc && bss_desc->ssid.ssid_len &&
                    (!mwifiex_ssid_cmp(&priv->curr_bss_params.bss_descriptor.
                                       ssid, &bss_desc->ssid))) {
-                       kfree(bss_desc);
-                       return 0;
+                       ret = 0;
+                       goto done;
                }
 
                /* Exit Adhoc mode first */
@@ -318,8 +313,7 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
 
                ret = mwifiex_check_network_compatibility(priv, bss_desc);
 
-               if (!netif_queue_stopped(priv->netdev))
-                       mwifiex_stop_net_dev_queue(priv->netdev, adapter);
+               mwifiex_stop_net_dev_queue(priv->netdev, adapter);
                if (netif_carrier_ok(priv->netdev))
                        netif_carrier_off(priv->netdev);
 
@@ -338,6 +332,7 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
        }
 
 done:
+       kfree(beacon_ie);
        kfree(bss_desc);
        return ret;
 }
@@ -480,8 +475,11 @@ int mwifiex_enable_hs(struct mwifiex_adapter *adapter)
                return false;
        }
 
-       wait_event_interruptible(adapter->hs_activate_wait_q,
-                                adapter->hs_activate_wait_q_woken);
+       if (wait_event_interruptible(adapter->hs_activate_wait_q,
+                                    adapter->hs_activate_wait_q_woken)) {
+               dev_err(adapter->dev, "hs_activate_wait_q terminated\n");
+               return false;
+       }
 
        return true;
 }