leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

staging: rtl8188eu: Fix potential NULL pointer dereference of kcalloc

Browse Source 
hwxmits is allocated via kcalloc and not checked for failure before its
dereference. The patch fixes this problem by returning error upstream
in rtl8723bs, rtl8188eu.

Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Acked-by: Mukesh Ojha <mojha@codeaurora.org>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Aditya Pakki 2019-03-20 12:21:35 -05:00 committed by Greg Kroah-Hartman
parent 90cd9bed5a
commit 7671ce0d92
4 changed files with 16 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/staging/rtl8188eu/core/rtw_xmit.c
View File

@ -174,7 +174,9 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter)
pxmitpriv->free_xmit_extbuf_cnt = num_xmit_extbuf;
rtw_alloc_hwxmits(padapter);
res = rtw_alloc_hwxmits(padapter);
if (res == _FAIL)
goto exit;
rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
for (i = 0; i < 4; i++)
@ -1503,7 +1505,7 @@ exit:
return res;
}
void rtw_alloc_hwxmits(struct adapter *padapter)
s32 rtw_alloc_hwxmits(struct adapter *padapter)
{
struct hw_xmit *hwxmits;
struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
@ -1512,6 +1514,8 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
pxmitpriv->hwxmits = kcalloc(pxmitpriv->hwxmit_entry,
sizeof(struct hw_xmit), GFP_KERNEL);
if (!pxmitpriv->hwxmits)
return _FAIL;
hwxmits = pxmitpriv->hwxmits;
@ -1519,6 +1523,7 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
hwxmits[1] .sta_queue = &pxmitpriv->vi_pending;
hwxmits[2] .sta_queue = &pxmitpriv->be_pending;
hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
return _SUCCESS;
}
void rtw_free_hwxmits(struct adapter *padapter)

2
drivers/staging/rtl8188eu/include/rtw_xmit.h
View File

@ -336,7 +336,7 @@ s32 rtw_txframes_sta_ac_pending(struct adapter *padapter,
void rtw_init_hwxmits(struct hw_xmit *phwxmit, int entry);
s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter);
void _rtw_free_xmit_priv(struct xmit_priv *pxmitpriv);
void rtw_alloc_hwxmits(struct adapter *padapter);
s32 rtw_alloc_hwxmits(struct adapter *padapter);
void rtw_free_hwxmits(struct adapter *padapter);
s32 rtw_xmit(struct adapter *padapter, struct sk_buff **pkt);

14
drivers/staging/rtl8723bs/core/rtw_xmit.c
View File

@ -260,7 +260,9 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter)
}
}
rtw_alloc_hwxmits(padapter);
res = rtw_alloc_hwxmits(padapter);
if (res == _FAIL)
goto exit;
rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
for (i = 0; i < 4; i++) {
@ -2144,7 +2146,7 @@ exit:
return res;
}
void rtw_alloc_hwxmits(struct adapter *padapter)
s32 rtw_alloc_hwxmits(struct adapter *padapter)
{
struct hw_xmit *hwxmits;
struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
@ -2155,10 +2157,8 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
pxmitpriv->hwxmits = rtw_zmalloc(sizeof(struct hw_xmit) * pxmitpriv->hwxmit_entry);
if (pxmitpriv->hwxmits == NULL) {
DBG_871X("alloc hwxmits fail!...\n");
return;
}
if (!pxmitpriv->hwxmits)
return _FAIL;
hwxmits = pxmitpriv->hwxmits;
@ -2204,7 +2204,7 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
}
return _SUCCESS;
}
void rtw_free_hwxmits(struct adapter *padapter)

2
drivers/staging/rtl8723bs/include/rtw_xmit.h
View File

@ -487,7 +487,7 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter);
void _rtw_free_xmit_priv (struct xmit_priv *pxmitpriv);
void rtw_alloc_hwxmits(struct adapter *padapter);
s32 rtw_alloc_hwxmits(struct adapter *padapter);
void rtw_free_hwxmits(struct adapter *padapter);