Showing error 1831

User: Jiri Slaby
Error type: Invalid Pointer Dereference
Error type description: A pointer which is invalid is being dereferenced
File location: drivers/net/wireless/p54/p54common.c
Line in file: 730
Project: Linux Kernel
Project version: 2.6.28
Confirmation: Fixed by b92f30d65aeb0502e2ed8beb80c8465578b40002
Tools: Smatch (1.59)
Entered: 2013-09-11 08:47:26 UTC


Source:

 700        while (left--) {
 701                u32 hole_size;
 702                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(entry);
 703                struct memrecord *range = (void *)info->driver_data;
 704                hole_size = range->start_addr - last_addr;
 705                if (!target_skb && hole_size >= len) {
 706                        target_skb = entry->prev;
 707                        hole_size -= len;
 708                        target_addr = last_addr;
 709                }
 710                largest_hole = max(largest_hole, hole_size);
 711                last_addr = range->end_addr;
 712                entry = entry->next;
 713        }
 714        if (!target_skb && priv->rx_end - last_addr >= len) {
 715                target_skb = priv->tx_queue.prev;
 716                largest_hole = max(largest_hole, priv->rx_end - last_addr - len);
 717                if (!skb_queue_empty(&priv->tx_queue)) {
 718                        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(target_skb);
 719                        struct memrecord *range = (void *)info->driver_data;
 720                        target_addr = range->end_addr;
 721                }
 722        } else
 723                largest_hole = max(largest_hole, priv->rx_end - last_addr);
 724
 725        if (skb) {
 726                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 727                struct memrecord *range = (void *)info->driver_data;
 728                range->start_addr = target_addr;
 729                range->end_addr = target_addr + len;
 730                __skb_queue_after(&priv->tx_queue, target_skb, skb);
 731                if (largest_hole < priv->rx_mtu + priv->headroom +
 732                                   priv->tailroom +
 733                                   sizeof(struct p54_control_hdr))
 734                        ieee80211_stop_queues(dev);
 735        }
 736        spin_unlock_irqrestore(&priv->tx_queue.lock, flags);
 737
 738        data->req_id = cpu_to_le32(target_addr + priv->headroom);
 739}
 740
Show full sources