When ieee80211_pspoll_get() returns NULL to skb, no error return code of
wl1271_cmd_build_ps_poll() is assigned.
To fix this bug, ret is assigned with -ENOMEM in this case.

Reported-by: TOTE Robot <os...@tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1...@gmail.com>
---
 drivers/net/wireless/ti/wlcore/cmd.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ti/wlcore/cmd.c 
b/drivers/net/wireless/ti/wlcore/cmd.c
index 32a2e27cc561..7bf8b8201fdd 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -1120,8 +1120,10 @@ int wl1271_cmd_build_ps_poll(struct wl1271 *wl, struct 
wl12xx_vif *wlvif,
        int ret = 0;
 
        skb = ieee80211_pspoll_get(wl->hw, vif);
-       if (!skb)
+       if (!skb) {
+               ret = -ENOMEM;
                goto out;
+       }
 
        ret = wl1271_cmd_template_set(wl, wlvif->role_id,
                                      CMD_TEMPL_PS_POLL, skb->data,
-- 
2.17.1

Reply via email to