Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bdc4bf65 authored by Jesper Juhl's avatar Jesper Juhl Committed by John W. Linville
Browse files

rtlwifi: Fix possible NULL dereference 



In drivers/net/wireless/rtlwifi/pci.c::_rtl_pci_rx_interrupt() we call
dev_alloc_skb(), which may fail and return NULL, but we do not check the
returned value against NULL before dereferencing the returned pointer.
This may lead to a NULL pointer dereference which means we'll crash - not
good.

In a separate call to dev_alloc_skb(), the debug level is changed so that
the failure message will always be logged.

Signed-off-by: default avatarJesper Juhl <jj@chaosbits.net>
Signed-off-by: default avatarLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 783cd01e

drivers/net/wireless/rtlwifi/pci.c

+9 −2
Original line number Diff line number Diff line
@@ -619,6 +619,13 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw) 
					struct sk_buff *uskb = NULL;

					u8 *pdata;

					uskb = dev_alloc_skb(skb->len + 128);

					if (!uskb) {

						RT_TRACE(rtlpriv,

							(COMP_INTR | COMP_RECV),

							DBG_EMERG,

							("can't alloc rx skb\n"));

						goto done;

					}

					memcpy(IEEE80211_SKB_RXCB(uskb),

							&rx_status,

							sizeof(rx_status));
@@ -641,7 +648,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw) 
			new_skb = dev_alloc_skb(rtlpci->rxbuffersize);

			if (unlikely(!new_skb)) {

				RT_TRACE(rtlpriv, (COMP_INTR | COMP_RECV),

					 DBG_DMESG,

					 DBG_EMERG,

					 ("can't alloc skb for rx\n"));

				goto done;

			}
@@ -1066,9 +1073,9 @@ static int _rtl_pci_init_rx_ring(struct ieee80211_hw *hw) 
			struct sk_buff *skb =

			    dev_alloc_skb(rtlpci->rxbuffersize);

			u32 bufferaddress;

			entry = &rtlpci->rx_ring[rx_queue_idx].desc[i];

			if (!skb)

				return 0;

			entry = &rtlpci->rx_ring[rx_queue_idx].desc[i];



			/*skb->dev = dev; */