When there is no enough memory, functions skb_clone() and dev_alloc_skb() may return NULL pointers, they should be checked against NULL before used.
This bug is found by a static analysis tool developed by RUC_SoftSec, supported by China.X.Orion.
Signed-off-by: RUC_SoftSec <rucsoftsec@xxxxxxxxx>
---
drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
index 1617f2e..1409025 100644
--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
@@ -849,7 +849,7 @@ u8 parse_subframe(struct sk_buff *skb,
#ifdef JOHN_NOCPY
sub_skb = skb_clone(skb, GFP_ATOMIC);
if (sub_skb == NULL) {
- printk("%s: skb_clone() failed, no enough memory\n", __FUNCTION__);
+ printk("%s: skb_clone() failed\n", __FUNCTION__);
return 0;
}
sub_skb->len = nSubframe_Length;
@@ -858,7 +858,7 @@ u8 parse_subframe(struct sk_buff *skb,
/* Allocate new skb for releasing to upper layer */
sub_skb = dev_alloc_skb(nSubframe_Length + 12);
if (sub_skb == NULL) {
- printk("%s: dev_alloc_skb() failed, no enough memory\n", __FUNCTION__);
+ printk("%s: dev_alloc_skb() failed\n", __FUNCTION__);
return 0;
}
skb_reserve(sub_skb, 12);
--
1.7.9.5
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
