diff options
author | Larry Finger <Larry.Finger@lwfinger.net> | 2012-01-07 21:46:40 -0500 |
---|---|---|
committer | John W. Linville <linville@tuxdriver.com> | 2012-01-24 14:08:37 -0500 |
commit | 76a92be537f1c8c259e393632301446257ca3ea9 (patch) | |
tree | 2b5e5b43f0eb4e16ac32b07254cb26383a0a0d35 /drivers/net/wireless/rtlwifi/usb.c | |
parent | 39d02a7d90602d4557ee05db2a157a4e0ec3a3d3 (diff) |
rtlwifi: rtl8192c_common: rtl8192de: Check for allocation failures
In https://bugzilla.redhat.com/show_bug.cgi?id=771656, a kernel bug was
triggered due to a failed skb allocation that was not checked. This event
lead to an audit of all memory allocations in the complete rtlwifi family
of drivers. This patch fixes the rest.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/rtlwifi/usb.c')
-rw-r--r-- | drivers/net/wireless/rtlwifi/usb.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c index 6ae1b212ad99..4db06f6f9084 100644 --- a/drivers/net/wireless/rtlwifi/usb.c +++ b/drivers/net/wireless/rtlwifi/usb.c | |||
@@ -520,12 +520,14 @@ static void _rtl_usb_rx_process_noagg(struct ieee80211_hw *hw, | |||
520 | u8 *pdata; | 520 | u8 *pdata; |
521 | 521 | ||
522 | uskb = dev_alloc_skb(skb->len + 128); | 522 | uskb = dev_alloc_skb(skb->len + 128); |
523 | memcpy(IEEE80211_SKB_RXCB(uskb), &rx_status, | 523 | if (uskb) { /* drop packet on allocation failure */ |
524 | sizeof(rx_status)); | 524 | memcpy(IEEE80211_SKB_RXCB(uskb), &rx_status, |
525 | pdata = (u8 *)skb_put(uskb, skb->len); | 525 | sizeof(rx_status)); |
526 | memcpy(pdata, skb->data, skb->len); | 526 | pdata = (u8 *)skb_put(uskb, skb->len); |
527 | memcpy(pdata, skb->data, skb->len); | ||
528 | ieee80211_rx_irqsafe(hw, uskb); | ||
529 | } | ||
527 | dev_kfree_skb_any(skb); | 530 | dev_kfree_skb_any(skb); |
528 | ieee80211_rx_irqsafe(hw, uskb); | ||
529 | } else { | 531 | } else { |
530 | dev_kfree_skb_any(skb); | 532 | dev_kfree_skb_any(skb); |
531 | } | 533 | } |