aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorRoel Kluin <roel.kluin@gmail.com>2009-08-31 06:26:43 -0400
committerGreg Kroah-Hartman <gregkh@suse.de>2009-09-15 15:02:33 -0400
commita89dfebdad050598479c73c1a22e2323085b5596 (patch)
tree64a4dc264ae9a349c106c1f5303a238e1c776dd3 /drivers
parent18526c7896fca5229c8d7b4b415605a17f9952d0 (diff)
Staging: rt2860: fix possible NULL dereferences
Allocations may fail, prevent NULL dereferences. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Acked-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/staging/rt2860/common/ba_action.c4
-rw-r--r--drivers/staging/rt2860/common/cmm_data.c2
-rw-r--r--drivers/staging/rt2860/rt_main_dev.c2
3 files changed, 8 insertions, 0 deletions
diff --git a/drivers/staging/rt2860/common/ba_action.c b/drivers/staging/rt2860/common/ba_action.c
index 79a51640f6bc..b7bbe99d4d57 100644
--- a/drivers/staging/rt2860/common/ba_action.c
+++ b/drivers/staging/rt2860/common/ba_action.c
@@ -867,6 +867,8 @@ VOID BAOriSessionTearDown(
867 // force send specified TID DelBA 867 // force send specified TID DelBA
868 MLME_DELBA_REQ_STRUCT DelbaReq; 868 MLME_DELBA_REQ_STRUCT DelbaReq;
869 MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG); 869 MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
870 if (Elem == NULL)
871 return;
870 872
871 NdisZeroMemory(&DelbaReq, sizeof(DelbaReq)); 873 NdisZeroMemory(&DelbaReq, sizeof(DelbaReq));
872 NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM)); 874 NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM));
@@ -900,6 +902,8 @@ VOID BAOriSessionTearDown(
900 { 902 {
901 MLME_DELBA_REQ_STRUCT DelbaReq; 903 MLME_DELBA_REQ_STRUCT DelbaReq;
902 MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG); 904 MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
905 if (Elem == NULL)
906 return;
903 907
904 NdisZeroMemory(&DelbaReq, sizeof(DelbaReq)); 908 NdisZeroMemory(&DelbaReq, sizeof(DelbaReq));
905 NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM)); 909 NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM));
diff --git a/drivers/staging/rt2860/common/cmm_data.c b/drivers/staging/rt2860/common/cmm_data.c
index abbbcbfcf26d..774fabb0be40 100644
--- a/drivers/staging/rt2860/common/cmm_data.c
+++ b/drivers/staging/rt2860/common/cmm_data.c
@@ -2011,6 +2011,8 @@ UINT deaggregate_AMSDU_announce(
2011 { 2011 {
2012 // avoid local heap overflow, use dyanamic allocation 2012 // avoid local heap overflow, use dyanamic allocation
2013 MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG); 2013 MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
2014 if (Elem == NULL)
2015 return;
2014 memmove(Elem->Msg+(LENGTH_802_11 + LENGTH_802_1_H), pPayload, PayloadSize); 2016 memmove(Elem->Msg+(LENGTH_802_11 + LENGTH_802_1_H), pPayload, PayloadSize);
2015 Elem->MsgLen = LENGTH_802_11 + LENGTH_802_1_H + PayloadSize; 2017 Elem->MsgLen = LENGTH_802_11 + LENGTH_802_1_H + PayloadSize;
2016 WpaEAPOLKeyAction(pAd, Elem); 2018 WpaEAPOLKeyAction(pAd, Elem);
diff --git a/drivers/staging/rt2860/rt_main_dev.c b/drivers/staging/rt2860/rt_main_dev.c
index 7f4441462a12..22f37cfbefbe 100644
--- a/drivers/staging/rt2860/rt_main_dev.c
+++ b/drivers/staging/rt2860/rt_main_dev.c
@@ -777,6 +777,8 @@ INT __devinit rt28xx_probe(
777 777
778 // Allocate RTMP_ADAPTER miniport adapter structure 778 // Allocate RTMP_ADAPTER miniport adapter structure
779 handle = kmalloc(sizeof(struct os_cookie), GFP_KERNEL); 779 handle = kmalloc(sizeof(struct os_cookie), GFP_KERNEL);
780 if (handle == NULL)
781 goto err_out_free_netdev;;
780 RT28XX_HANDLE_DEV_ASSIGN(handle, dev_p); 782 RT28XX_HANDLE_DEV_ASSIGN(handle, dev_p);
781 783
782 status = RTMPAllocAdapterBlock(handle, &pAd); 784 status = RTMPAllocAdapterBlock(handle, &pAd);