rtl8192se: Fix BUG caused by failure to check skb allocation
authorLarry Finger <Larry.Finger@lwfinger.net>
Thu, 5 Jan 2012 02:50:47 +0000 (20:50 -0600)
committerJohn W. Linville <linville@tuxdriver.com>
Tue, 10 Jan 2012 20:46:39 +0000 (15:46 -0500)
When downloading firmware into the device, the driver fails to check the
return when allocating an skb. When the allocation fails, a BUG can be
generated, as seen in https://bugzilla.redhat.com/show_bug.cgi?id=771656.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/rtlwifi/rtl8192se/fw.c

index 6f91a148c2220ad2f4694c21a4f47e52822912e2..3fda6b1dcf465ee3fcda52a5807d78dedb50c760 100644 (file)
@@ -196,6 +196,8 @@ static bool _rtl92s_firmware_downloadcode(struct ieee80211_hw *hw,
                /* Allocate skb buffer to contain firmware */
                /* info and tx descriptor info. */
                skb = dev_alloc_skb(frag_length);
+               if (!skb)
+                       return false;
                skb_reserve(skb, extra_descoffset);
                seg_ptr = (u8 *)skb_put(skb, (u32)(frag_length -
                                        extra_descoffset));
@@ -573,6 +575,8 @@ static bool _rtl92s_firmware_set_h2c_cmd(struct ieee80211_hw *hw, u8 h2c_cmd,
 
        len = _rtl92s_get_h2c_cmdlen(MAX_TRANSMIT_BUFFER_SIZE, 1, &cmd_len);
        skb = dev_alloc_skb(len);
+       if (!skb)
+               return false;
        cb_desc = (struct rtl_tcb_desc *)(skb->cb);
        cb_desc->queue_index = TXCMD_QUEUE;
        cb_desc->cmd_or_init = DESC_PACKET_TYPE_NORMAL;