Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dc3f89c3 authored by Pan Bian's avatar Pan Bian Committed by Kalle Valo
Browse files

libertas: check return value of alloc_workqueue 



Function alloc_workqueue() will return a NULL pointer if there is no
enough memory, and its return value should be validated before using.
However, in function if_spi_probe(), its return value is not checked.
This may result in a NULL dereference bug. This patch fixes the bug.

Signed-off-by: default avatarPan Bian <bianpan2016@163.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent 5fb01e91

drivers/net/wireless/marvell/libertas/if_spi.c

+5 −0
Original line number Diff line number Diff line
@@ -1181,6 +1181,10 @@ static int if_spi_probe(struct spi_device *spi) 


	/* Initialize interrupt handling stuff. */

	card->workqueue = alloc_workqueue("libertas_spi", WQ_MEM_RECLAIM, 0);

	if (!card->workqueue) {

		err = -ENOMEM;

		goto remove_card;

	}

	INIT_WORK(&card->packet_work, if_spi_host_to_card_worker);

	INIT_WORK(&card->resume_work, if_spi_resume_worker);
@@ -1209,6 +1213,7 @@ static int if_spi_probe(struct spi_device *spi) 
	free_irq(spi->irq, card);

terminate_workqueue:

	destroy_workqueue(card->workqueue);

remove_card:

	lbs_remove_card(priv); /* will call free_netdev */

free_card:

	free_if_spi_card(card);