brcmsmac: fix smatch warning found in ampdu.c

This patch fixes potential NULL pointer dereference in ampdu. This
was found running smatch static code checker. Smatch warning says:

drivers/net/wireless/brcm80211/brcmsmac/ampdu.c:741 brcms_c_sendampdu()
	 warn: variable dereferenced before check 'p'

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
index 95b5902bc4b3a3241f68cde20434b8592ba71ebc..01b190a25d947766ac2565ace38b6c9c096e7261 100644 (file)
--- a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
@@ -735,10 +735,8 @@ brcms_c_sendampdu(struct ampdu_info *ampdu, struct brcms_txq_info *qi,
                 * a candidate for aggregation
                 */
                p = pktq_ppeek(&qi->q, prec);
-               /* tx_info must be checked with current p */
-               tx_info = IEEE80211_SKB_CB(p);
-
                if (p) {
+                       tx_info = IEEE80211_SKB_CB(p);
                        if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) &&
                            ((u8) (p->priority) == tid)) {
                                plen = p->len + AMPDU_MAX_MPDU_OVERHEAD;
@@ -759,6 +757,7 @@ brcms_c_sendampdu(struct ampdu_info *ampdu, struct brcms_txq_info *qi,
                                        p = NULL;
                                        continue;
                                }
+                               /* next packet fit for aggregation so dequeue */
                                p = brcmu_pktq_pdeq(&qi->q, prec);
                        } else {
                                p = NULL;