diff options
| author | Rajkumar Manoharan <rmanohar@qca.qualcomm.com> | 2011-07-17 11:38:49 +0530 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2011-07-18 14:29:46 -0400 |
| commit | 02c5172c314308eb85f80899cc3aef41bc31bbad (patch) | |
| tree | 3a9e4d865fc932cf665f358eb5fdd1146802e8ea | |
| parent | f9ab38ba95c718ba07b385720803ed29ff40d1e3 (diff) | |
ath9k: Fix some smatch warnings
drivers/net/wireless/ath/ath9k/hif_usb.c +135 hif_usb_mgmt_cb(6) warn:
variable dereferenced before check 'cmd'
drivers/net/wireless/ath/ath9k/btcoex.c +77 ath9k_hw_init_btcoex_hw(38)
error: buffer overflow 'ah->hw_gen_timers.gen_timer_index' 32 <=
2009813776
Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/ath/ath9k/btcoex.c | 8 | ||||
| -rw-r--r-- | drivers/net/wireless/ath/ath9k/hif_usb.c | 4 |
2 files changed, 8 insertions, 4 deletions
diff --git a/drivers/net/wireless/ath/ath9k/btcoex.c b/drivers/net/wireless/ath/ath9k/btcoex.c index 41ce0b13988..6635c377dc0 100644 --- a/drivers/net/wireless/ath/ath9k/btcoex.c +++ b/drivers/net/wireless/ath/ath9k/btcoex.c @@ -50,7 +50,7 @@ void ath9k_hw_init_btcoex_hw(struct ath_hw *ah, int qnum) .bt_first_slot_time = 5, .bt_hold_rx_clear = true, }; - u32 i; + u32 i, idx; bool rxclear_polarity = ath_bt_config.bt_rxclear_polarity; if (AR_SREV_9300_20_OR_LATER(ah)) @@ -73,8 +73,10 @@ void ath9k_hw_init_btcoex_hw(struct ath_hw *ah, int qnum) SM(ATH_BTCOEX_BMISS_THRESH, AR_BT_BCN_MISS_THRESH) | AR_BT_DISABLE_BT_ANT; - for (i = 0; i < 32; i++) - ah->hw_gen_timers.gen_timer_index[(debruijn32 << i) >> 27] = i; + for (i = 0; i < 32; i++) { + idx = (debruijn32 << i) >> 27; + ah->hw_gen_timers.gen_timer_index[idx] = i; + } } EXPORT_SYMBOL(ath9k_hw_init_btcoex_hw); diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c index 1d11ae101d6..d3f4a59cd45 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -130,12 +130,14 @@ static int hif_usb_send_regout(struct hif_device_usb *hif_dev, static void hif_usb_mgmt_cb(struct urb *urb) { struct cmd_buf *cmd = (struct cmd_buf *)urb->context; - struct hif_device_usb *hif_dev = cmd->hif_dev; + struct hif_device_usb *hif_dev; bool txok = true; if (!cmd || !cmd->skb || !cmd->hif_dev) return; + hif_dev = cmd->hif_dev; + switch (urb->status) { case 0: break; |