diff options
| author | Larry Finger <Larry.Finger@lwfinger.net> | 2012-01-04 20:50:47 -0600 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2012-01-25 17:24:42 -0800 |
| commit | 93d150e945fdaceb9e8fe18c7b9014569123195d (patch) | |
| tree | 34e567a15b4ad54a4c6d2c08e7a3785a1a860bd9 /drivers | |
| parent | 982e49a7cbcca1347b701e2098431153d83c3dd2 (diff) | |
| download | kernel_samsung_smdk4412-93d150e945fdaceb9e8fe18c7b9014569123195d.zip kernel_samsung_smdk4412-93d150e945fdaceb9e8fe18c7b9014569123195d.tar.gz kernel_samsung_smdk4412-93d150e945fdaceb9e8fe18c7b9014569123195d.tar.bz2 | |
rtl8192se: Fix BUG caused by failure to check skb allocation
commit d90db4b12bc1b9b8a787ef28550fdb767ee25a49 upstream.
When downloading firmware into the device, the driver fails to check the
return when allocating an skb. When the allocation fails, a BUG can be
generated, as seen in https://bugzilla.redhat.com/show_bug.cgi?id=771656.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/wireless/rtlwifi/rtl8192se/fw.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/fw.c b/drivers/net/wireless/rtlwifi/rtl8192se/fw.c index 3b5af01..0c77a14 100644 --- a/drivers/net/wireless/rtlwifi/rtl8192se/fw.c +++ b/drivers/net/wireless/rtlwifi/rtl8192se/fw.c @@ -196,6 +196,8 @@ static bool _rtl92s_firmware_downloadcode(struct ieee80211_hw *hw, /* Allocate skb buffer to contain firmware */ /* info and tx descriptor info. */ skb = dev_alloc_skb(frag_length); + if (!skb) + return false; skb_reserve(skb, extra_descoffset); seg_ptr = (u8 *)skb_put(skb, (u32)(frag_length - extra_descoffset)); @@ -575,6 +577,8 @@ static bool _rtl92s_firmware_set_h2c_cmd(struct ieee80211_hw *hw, u8 h2c_cmd, len = _rtl92s_get_h2c_cmdlen(MAX_TRANSMIT_BUFFER_SIZE, 1, &cmd_len); skb = dev_alloc_skb(len); + if (!skb) + return false; cb_desc = (struct rtl_tcb_desc *)(skb->cb); cb_desc->queue_index = TXCMD_QUEUE; cb_desc->cmd_or_init = DESC_PACKET_TYPE_NORMAL; |