When ieee80211_pspoll_get() returns NULL to skb, no error return code of wl1271_cmd_build_ps_poll() is assigned. To fix this bug, ret is assigned with -ENOMEM in this case.
Reported-by: TOTE Robot <os...@tsinghua.edu.cn> Signed-off-by: Jia-Ju Bai <baijiaju1...@gmail.com> --- drivers/net/wireless/ti/wlcore/cmd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c index 32a2e27cc561..7bf8b8201fdd 100644 --- a/drivers/net/wireless/ti/wlcore/cmd.c +++ b/drivers/net/wireless/ti/wlcore/cmd.c @@ -1120,8 +1120,10 @@ int wl1271_cmd_build_ps_poll(struct wl1271 *wl, struct wl12xx_vif *wlvif, int ret = 0; skb = ieee80211_pspoll_get(wl->hw, vif); - if (!skb) + if (!skb) { + ret = -ENOMEM; goto out; + } ret = wl1271_cmd_template_set(wl, wlvif->role_id, CMD_TEMPL_PS_POLL, skb->data, -- 2.17.1