evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Staging: rt2860: fix possible NULL dereferences

Browse source 
Allocations may fail, prevent NULL dereferences.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Acked-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Roel Kluin 2009-08-31 12:26:43 +02:00 • committed by Greg Kroah-Hartman
parent 18526c7896
commit a89dfebdad
3 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
drivers/staging/rt2860/common/ba_action.c
View file

@ -867,6 +867,8 @@ VOID BAOriSessionTearDown(
// force send specified TID DelBA // force send specified TID DelBA
MLME_DELBA_REQ_STRUCT DelbaReq; MLME_DELBA_REQ_STRUCT DelbaReq;
MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG); MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
if (Elem == NULL)
return;
NdisZeroMemory(&DelbaReq, sizeof(DelbaReq)); NdisZeroMemory(&DelbaReq, sizeof(DelbaReq));
NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM)); NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM));
@ -900,6 +902,8 @@ VOID BAOriSessionTearDown(
{ {
MLME_DELBA_REQ_STRUCT DelbaReq; MLME_DELBA_REQ_STRUCT DelbaReq;
MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG); MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
if (Elem == NULL)
return;
NdisZeroMemory(&DelbaReq, sizeof(DelbaReq)); NdisZeroMemory(&DelbaReq, sizeof(DelbaReq));
NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM)); NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM));

2
drivers/staging/rt2860/common/cmm_data.c
View file

@ -2011,6 +2011,8 @@ UINT deaggregate_AMSDU_announce(
{ {
// avoid local heap overflow, use dyanamic allocation // avoid local heap overflow, use dyanamic allocation
MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG); MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
if (Elem == NULL)
return;
memmove(Elem->Msg+(LENGTH_802_11 + LENGTH_802_1_H), pPayload, PayloadSize); memmove(Elem->Msg+(LENGTH_802_11 + LENGTH_802_1_H), pPayload, PayloadSize);
Elem->MsgLen = LENGTH_802_11 + LENGTH_802_1_H + PayloadSize; Elem->MsgLen = LENGTH_802_11 + LENGTH_802_1_H + PayloadSize;
WpaEAPOLKeyAction(pAd, Elem); WpaEAPOLKeyAction(pAd, Elem);

2
drivers/staging/rt2860/rt_main_dev.c
View file

@ -777,6 +777,8 @@ INT __devinit rt28xx_probe(
// Allocate RTMP_ADAPTER miniport adapter structure // Allocate RTMP_ADAPTER miniport adapter structure
handle = kmalloc(sizeof(struct os_cookie), GFP_KERNEL); handle = kmalloc(sizeof(struct os_cookie), GFP_KERNEL);
if (handle == NULL)
goto err_out_free_netdev;;
RT28XX_HANDLE_DEV_ASSIGN(handle, dev_p); RT28XX_HANDLE_DEV_ASSIGN(handle, dev_p);
status = RTMPAllocAdapterBlock(handle, &pAd); status = RTMPAllocAdapterBlock(handle, &pAd);