[PATCH] Check ieee80211softmac_auth_resp kmalloc result

And use kmemdup and kzalloc where applicable

Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

3 files changed, 14 insertions, 12 deletions

diff --git a/net/ieee80211/ieee80211_module.c b/net/ieee80211/ieee80211_module.c
index 2b14c2f3e21d..f16e60ee9ce9 100644
--- a/net/ieee80211/ieee80211_module.c
+++ b/net/ieee80211/ieee80211_module.c
@@ -67,7 +67,7 @@ static int ieee80211_networks_allocate(struct ieee80211_device *ieee)
                 return 0;
 
         ieee->networks =
-            kmalloc(MAX_NETWORK_COUNT * sizeof(struct ieee80211_network),
+            kzalloc(MAX_NETWORK_COUNT * sizeof(struct ieee80211_network),
                     GFP_KERNEL);
         if (!ieee->networks) {
                 printk(KERN_WARNING "%s: Out of memory allocating beacons\n",
@@ -75,9 +75,6 @@ static int ieee80211_networks_allocate(struct ieee80211_device *ieee)
                 return -ENOMEM;
         }
 
-        memset(ieee->networks, 0,
-               MAX_NETWORK_COUNT * sizeof(struct ieee80211_network));
-
         return 0;
 }
 
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index ce28d571afac..d97e5412e31b 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -1304,12 +1304,11 @@ static int ieee80211_parse_info_param(struct ieee80211_info_element
                 case MFIE_TYPE_IBSS_DFS:
                         if (network->ibss_dfs)
                                 break;
-                        network->ibss_dfs =
-                            kmalloc(info_element->len, GFP_ATOMIC);
+                        network->ibss_dfs = kmemdup(info_element->data,
+                                                    info_element->len,
+                                                    GFP_ATOMIC);
                         if (!network->ibss_dfs)
                                 return 1;
-                        memcpy(network->ibss_dfs, info_element->data,
-                               info_element->len);
                         network->flags |= NETWORK_HAS_IBSS_DFS;
                         break;
 
diff --git a/net/ieee80211/softmac/ieee80211softmac_auth.c b/net/ieee80211/softmac/ieee80211softmac_auth.c
index 95e5287e12bb..0612015f1c78 100644
--- a/net/ieee80211/softmac/ieee80211softmac_auth.c
+++ b/net/ieee80211/softmac/ieee80211softmac_auth.c
@@ -216,10 +216,16 @@ ieee80211softmac_auth_resp(struct net_device *dev, struct ieee80211_auth *auth)
                         net->challenge_len = *data++;   
                         if (net->challenge_len > WLAN_AUTH_CHALLENGE_LEN)
                                 net->challenge_len = WLAN_AUTH_CHALLENGE_LEN;
-                        if (net->challenge != NULL)
-                                kfree(net->challenge);
-                        net->challenge = kmalloc(net->challenge_len, GFP_ATOMIC);
-                        memcpy(net->challenge, data, net->challenge_len);
+                        kfree(net->challenge);
+                        net->challenge = kmemdup(data, net->challenge_len,
+                                                 GFP_ATOMIC);
+                        if (net->challenge == NULL) {
+                                printkl(KERN_NOTICE PFX "Shared Key "
+                                        "Authentication failed due to "
+                                        "memory shortage.\n");
+                                spin_unlock_irqrestore(&mac->lock, flags);
+                                break;
+                        }
                         aq->state = IEEE80211SOFTMAC_AUTH_SHARED_RESPONSE; 
 
                         /* We reuse the work struct from the auth request here.