Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a89dfebd authored by Roel Kluin's avatar Roel Kluin Committed by Greg Kroah-Hartman
Browse files

Staging: rt2860: fix possible NULL dereferences 



Allocations may fail, prevent NULL dereferences.

Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Acked-by: default avatarBartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 18526c78

drivers/staging/rt2860/common/ba_action.c

+4 −0
Original line number Diff line number Diff line
@@ -867,6 +867,8 @@ VOID BAOriSessionTearDown( 
			// force send specified TID DelBA

			MLME_DELBA_REQ_STRUCT   DelbaReq;

			MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);

			if (Elem == NULL)

				return;



			NdisZeroMemory(&DelbaReq, sizeof(DelbaReq));

			NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM));
@@ -900,6 +902,8 @@ VOID BAOriSessionTearDown( 
	{

		MLME_DELBA_REQ_STRUCT   DelbaReq;

		MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);

		if (Elem == NULL)

			return;



		NdisZeroMemory(&DelbaReq, sizeof(DelbaReq));

		NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM));

drivers/staging/rt2860/common/cmm_data.c

+2 −0
Original line number Diff line number Diff line
@@ -2011,6 +2011,8 @@ UINT deaggregate_AMSDU_announce( 
		{

		    // avoid local heap overflow, use dyanamic allocation

		   MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);

		   if (Elem == NULL)

			return;

		   memmove(Elem->Msg+(LENGTH_802_11 + LENGTH_802_1_H), pPayload, PayloadSize);

		   Elem->MsgLen = LENGTH_802_11 + LENGTH_802_1_H + PayloadSize;

		   WpaEAPOLKeyAction(pAd, Elem);

drivers/staging/rt2860/rt_main_dev.c

+2 −0
Original line number Diff line number Diff line
@@ -777,6 +777,8 @@ INT __devinit rt28xx_probe( 


	// Allocate RTMP_ADAPTER miniport adapter structure

	handle = kmalloc(sizeof(struct os_cookie), GFP_KERNEL);

	if (handle == NULL)

		goto err_out_free_netdev;;

	RT28XX_HANDLE_DEV_ASSIGN(handle, dev_p);



	status = RTMPAllocAdapterBlock(handle, &pAd);