Skip to content

Commit 60209d4

Browse files
Ping-Ke ShihKalle Valo
authored andcommitted
rtlwifi: fix potential NULL pointer dereference
In case dev_alloc_skb fails, the fix safely returns to avoid potential NULL pointer dereference. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
1 parent 7659762 commit 60209d4

6 files changed

Lines changed: 14 additions & 0 deletions

File tree

drivers/net/wireless/realtek/rtlwifi/rtl8188ee/fw.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -600,6 +600,8 @@ void rtl88e_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
600600
u1rsvdpageloc, 3);
601601

602602
skb = dev_alloc_skb(totalpacketlen);
603+
if (!skb)
604+
return;
603605
skb_put_data(skb, &reserved_page_packet, totalpacketlen);
604606

605607
rtstatus = rtl_cmd_send_packet(hw, skb);

drivers/net/wireless/realtek/rtlwifi/rtl8192c/fw_common.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -623,6 +623,8 @@ void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw,
623623
u1rsvdpageloc, 3);
624624

625625
skb = dev_alloc_skb(totalpacketlen);
626+
if (!skb)
627+
return;
626628
skb_put_data(skb, &reserved_page_packet, totalpacketlen);
627629

628630
if (cmd_send_packet)

drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -744,6 +744,8 @@ void rtl92ee_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
744744
u1rsvdpageloc, 3);
745745

746746
skb = dev_alloc_skb(totalpacketlen);
747+
if (!skb)
748+
return;
747749
skb_put_data(skb, &reserved_page_packet, totalpacketlen);
748750

749751
rtstatus = rtl_cmd_send_packet(hw, skb);

drivers/net/wireless/realtek/rtlwifi/rtl8723ae/fw.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -448,6 +448,8 @@ void rtl8723e_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
448448
u1rsvdpageloc, 3);
449449

450450
skb = dev_alloc_skb(totalpacketlen);
451+
if (!skb)
452+
return;
451453
skb_put_data(skb, &reserved_page_packet, totalpacketlen);
452454

453455
rtstatus = rtl_cmd_send_packet(hw, skb);

drivers/net/wireless/realtek/rtlwifi/rtl8723be/fw.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -562,6 +562,8 @@ void rtl8723be_set_fw_rsvdpagepkt(struct ieee80211_hw *hw,
562562
u1rsvdpageloc, sizeof(u1rsvdpageloc));
563563

564564
skb = dev_alloc_skb(totalpacketlen);
565+
if (!skb)
566+
return;
565567
skb_put_data(skb, &reserved_page_packet, totalpacketlen);
566568

567569
rtstatus = rtl_cmd_send_packet(hw, skb);

drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1623,6 +1623,8 @@ void rtl8812ae_set_fw_rsvdpagepkt(struct ieee80211_hw *hw,
16231623
&reserved_page_packet_8812[0], totalpacketlen);
16241624

16251625
skb = dev_alloc_skb(totalpacketlen);
1626+
if (!skb)
1627+
return;
16261628
skb_put_data(skb, &reserved_page_packet_8812, totalpacketlen);
16271629

16281630
rtstatus = rtl_cmd_send_packet(hw, skb);
@@ -1759,6 +1761,8 @@ void rtl8821ae_set_fw_rsvdpagepkt(struct ieee80211_hw *hw,
17591761
&reserved_page_packet_8821[0], totalpacketlen);
17601762

17611763
skb = dev_alloc_skb(totalpacketlen);
1764+
if (!skb)
1765+
return;
17621766
skb_put_data(skb, &reserved_page_packet_8821, totalpacketlen);
17631767

17641768
rtstatus = rtl_cmd_send_packet(hw, skb);

0 commit comments

Comments
 (0)