Allocations may fail, prevent NULL dereferences.
Signed-off-by: Roel Kluin <roel.kluin@xxxxxxxxx>
---
In drivers/staging/rt2860/rt_main_dev.c rt28xx_probe()
`handle' isn't freed in the case of later errors, shouldn't
this occur as well?
diff --git a/drivers/staging/rt2860/common/ba_action.c b/drivers/staging/rt2860/common/ba_action.c
index b95a341..90c86db 100644
--- a/drivers/staging/rt2860/common/ba_action.c
+++ b/drivers/staging/rt2860/common/ba_action.c
@@ -869,6 +869,8 @@ VOID BAOriSessionTearDown(
// force send specified TID DelBA
MLME_DELBA_REQ_STRUCT DelbaReq;
MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
+ if (Elem == NULL)
+ return;
NdisZeroMemory(&DelbaReq, sizeof(DelbaReq));
NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM));
@@ -902,6 +904,8 @@ VOID BAOriSessionTearDown(
{
MLME_DELBA_REQ_STRUCT DelbaReq;
MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
+ if (Elem == NULL)
+ return;
NdisZeroMemory(&DelbaReq, sizeof(DelbaReq));
NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM));
diff --git a/drivers/staging/rt2860/common/cmm_data.c b/drivers/staging/rt2860/common/cmm_data.c
index 66eca20..9da1d82 100644
--- a/drivers/staging/rt2860/common/cmm_data.c
+++ b/drivers/staging/rt2860/common/cmm_data.c
@@ -2296,6 +2296,8 @@ UINT deaggregate_AMSDU_announce(
{
// avoid local heap overflow, use dyanamic allocation
MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
+ if (Elem == NULL)
+ return;
memmove(Elem->Msg+(LENGTH_802_11 + LENGTH_802_1_H), pPayload, PayloadSize);
Elem->MsgLen = LENGTH_802_11 + LENGTH_802_1_H + PayloadSize;
WpaEAPOLKeyAction(pAd, Elem);
diff --git a/drivers/staging/rt2860/rt_main_dev.c b/drivers/staging/rt2860/rt_main_dev.c
index f298b9b..a2f6734 100644
--- a/drivers/staging/rt2860/rt_main_dev.c
+++ b/drivers/staging/rt2860/rt_main_dev.c
@@ -791,6 +791,8 @@ INT __devinit rt28xx_probe(
// Allocate RTMP_ADAPTER miniport adapter structure
handle = kmalloc(sizeof(struct os_cookie), GFP_KERNEL);
+ if (handle == NULL)
+ goto err_out_free_netdev;;
RT28XX_HANDLE_DEV_ASSIGN(handle, dev_p);
status = RTMPAllocAdapterBlock(handle, &pAd);
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/devel
