Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6849e040 authored by Aditya Pakki's avatar Aditya Pakki Committed by Greg Kroah-Hartman
Browse files

staging: rtl8188eu: Fix potential NULL pointer dereference of kcalloc 



[ Upstream commit 7671ce0d92933762f469266daf43bd34d422d58c ]

hwxmits is allocated via kcalloc and not checked for failure before its
dereference. The patch fixes this problem by returning error upstream
in rtl8723bs, rtl8188eu.

Signed-off-by: default avatarAditya Pakki <pakki001@umn.edu>
Acked-by: default avatarMukesh Ojha <mojha@codeaurora.org>
Reviewed-by: default avatarHans de Goede <hdegoede@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarSasha Levin (Microsoft) <sashal@kernel.org>
parent b6ca8ec8

drivers/staging/rtl8188eu/core/rtw_xmit.c

+7 −2
Original line number Diff line number Diff line
@@ -188,7 +188,9 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter) 


	pxmitpriv->free_xmit_extbuf_cnt = num_xmit_extbuf;



	rtw_alloc_hwxmits(padapter);

	res = rtw_alloc_hwxmits(padapter);

	if (res == _FAIL)

		goto exit;

	rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);



	for (i = 0; i < 4; i++)
@@ -1573,7 +1575,7 @@ s32 rtw_xmit_classifier(struct adapter *padapter, struct xmit_frame *pxmitframe) 
	return res;

}



void rtw_alloc_hwxmits(struct adapter *padapter)

s32 rtw_alloc_hwxmits(struct adapter *padapter)

{

	struct hw_xmit *hwxmits;

	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
@@ -1582,6 +1584,8 @@ void rtw_alloc_hwxmits(struct adapter *padapter) 


	pxmitpriv->hwxmits = kcalloc(pxmitpriv->hwxmit_entry,

				     sizeof(struct hw_xmit), GFP_KERNEL);

	if (!pxmitpriv->hwxmits)

		return _FAIL;



	hwxmits = pxmitpriv->hwxmits;
@@ -1589,6 +1593,7 @@ void rtw_alloc_hwxmits(struct adapter *padapter) 
	hwxmits[1] .sta_queue = &pxmitpriv->vi_pending;

	hwxmits[2] .sta_queue = &pxmitpriv->be_pending;

	hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;

	return _SUCCESS;

}



void rtw_free_hwxmits(struct adapter *padapter)

drivers/staging/rtl8188eu/include/rtw_xmit.h

+1 −1
Original line number Diff line number Diff line
@@ -342,7 +342,7 @@ s32 rtw_txframes_sta_ac_pending(struct adapter *padapter, 
void rtw_init_hwxmits(struct hw_xmit *phwxmit, int entry);

s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter);

void _rtw_free_xmit_priv(struct xmit_priv *pxmitpriv);

void rtw_alloc_hwxmits(struct adapter *padapter);

s32 rtw_alloc_hwxmits(struct adapter *padapter);

void rtw_free_hwxmits(struct adapter *padapter);

s32 rtw_xmit(struct adapter *padapter, struct sk_buff **pkt);

drivers/staging/rtl8723bs/core/rtw_xmit.c

+7 −7
Original line number Diff line number Diff line
@@ -271,7 +271,9 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter) 
		}

	}



	rtw_alloc_hwxmits(padapter);

	res = rtw_alloc_hwxmits(padapter);

	if (res == _FAIL)

		goto exit;

	rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);



	for (i = 0; i < 4; i++) {
@@ -2157,7 +2159,7 @@ s32 rtw_xmit_classifier(struct adapter *padapter, struct xmit_frame *pxmitframe) 
	return res;

}



void rtw_alloc_hwxmits(struct adapter *padapter)

s32 rtw_alloc_hwxmits(struct adapter *padapter)

{

	struct hw_xmit *hwxmits;

	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
@@ -2168,10 +2170,8 @@ void rtw_alloc_hwxmits(struct adapter *padapter) 


	pxmitpriv->hwxmits = (struct hw_xmit *)rtw_zmalloc(sizeof(struct hw_xmit) * pxmitpriv->hwxmit_entry);



	if (pxmitpriv->hwxmits == NULL) {

		DBG_871X("alloc hwxmits fail!...\n");

		return;

	}

	if (!pxmitpriv->hwxmits)

		return _FAIL;



	hwxmits = pxmitpriv->hwxmits;
@@ -2217,7 +2217,7 @@ void rtw_alloc_hwxmits(struct adapter *padapter) 


	}





	return _SUCCESS;

}



void rtw_free_hwxmits(struct adapter *padapter)

drivers/staging/rtl8723bs/include/rtw_xmit.h

+1 −1
Original line number Diff line number Diff line
@@ -494,7 +494,7 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter); 
void _rtw_free_xmit_priv (struct xmit_priv *pxmitpriv);





void rtw_alloc_hwxmits(struct adapter *padapter);

s32 rtw_alloc_hwxmits(struct adapter *padapter);

void rtw_free_hwxmits(struct adapter *padapter);