1 files changed, 39 insertions, 0 deletions
diff --git a/package/kernel/mac80211/patches/351-0001-brcmfmac-testing-the-wrong-variable-in-brcmf_rx_hdrp.patch b/package/kernel/mac80211/patches/351-0001-brcmfmac-testing-the-wrong-variable-in-brcmf_rx_hdrp.patch
new file mode 100644
index 0000000000..11c65a49ed
--- /dev/null
+++ b/package/kernel/mac80211/patches/351-0001-brcmfmac-testing-the-wrong-variable-in-brcmf_rx_hdrp.patch
@@ -0,0 +1,39 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 19 Apr 2016 07:25:43 -0700
+Subject: [PATCH] brcmfmac: testing the wrong variable in brcmf_rx_hdrpull()
+
+Smatch complains about this code:
+
+    drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c:335 brcmf_rx_hdrpull()
+    error: we previously assumed '*ifp' could be null (see line 333)
+
+The problem is that we recently changed these from "ifp" to "*ifp" but
+there was one that we didn't update.
+
+-       if (ret || !ifp || !ifp->ndev) {
++       if (ret || !(*ifp) || !(*ifp)->ndev) {
+                if (ret != -ENODATA && ifp)
+                                       ^^^
+-                       ifp->stats.rx_errors++;
++                       (*ifp)->stats.rx_errors++;
+
+I have updated it to *ifp as well.  We always call this function is a
+non-NULL "ifp" pointer, btw.
+
+Fixes: c462ebcdfe42 ('brcmfmac: create common function for handling brcmf_proto_hdrpull()')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -331,7 +331,7 @@ static int brcmf_rx_hdrpull(struct brcmf
+ 	ret = brcmf_proto_hdrpull(drvr, true, skb, ifp);
+ 
+ 	if (ret || !(*ifp) || !(*ifp)->ndev) {
+-		if (ret != -ENODATA && ifp)
++		if (ret != -ENODATA && *ifp)
+ 			(*ifp)->stats.rx_errors++;
+ 		brcmu_pkt_buf_free_skb(skb);
+ 		return -ENODATA;