diff options
| author | Roel Kluin <roel.kluin@gmail.com> | 2009-08-31 12:26:43 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-09-15 12:02:33 -0700 |
| commit | a89dfebdad050598479c73c1a22e2323085b5596 (patch) | |
| tree | 64a4dc264ae9a349c106c1f5303a238e1c776dd3 /drivers/staging | |
| parent | 18526c7896fca5229c8d7b4b415605a17f9952d0 (diff) | |
Staging: rt2860: fix possible NULL dereferences
Allocations may fail, prevent NULL dereferences.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Acked-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/staging')
| -rw-r--r-- | drivers/staging/rt2860/common/ba_action.c | 4 | ||||
| -rw-r--r-- | drivers/staging/rt2860/common/cmm_data.c | 2 | ||||
| -rw-r--r-- | drivers/staging/rt2860/rt_main_dev.c | 2 |
3 files changed, 8 insertions, 0 deletions
diff --git a/drivers/staging/rt2860/common/ba_action.c b/drivers/staging/rt2860/common/ba_action.c index 79a51640f6bc..b7bbe99d4d57 100644 --- a/drivers/staging/rt2860/common/ba_action.c +++ b/drivers/staging/rt2860/common/ba_action.c @@ -867,6 +867,8 @@ VOID BAOriSessionTearDown( // force send specified TID DelBA MLME_DELBA_REQ_STRUCT DelbaReq; MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG); + if (Elem == NULL) + return; NdisZeroMemory(&DelbaReq, sizeof(DelbaReq)); NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM)); @@ -900,6 +902,8 @@ VOID BAOriSessionTearDown( { MLME_DELBA_REQ_STRUCT DelbaReq; MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG); + if (Elem == NULL) + return; NdisZeroMemory(&DelbaReq, sizeof(DelbaReq)); NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM)); diff --git a/drivers/staging/rt2860/common/cmm_data.c b/drivers/staging/rt2860/common/cmm_data.c index abbbcbfcf26d..774fabb0be40 100644 --- a/drivers/staging/rt2860/common/cmm_data.c +++ b/drivers/staging/rt2860/common/cmm_data.c @@ -2011,6 +2011,8 @@ UINT deaggregate_AMSDU_announce( { // avoid local heap overflow, use dyanamic allocation MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG); + if (Elem == NULL) + return; memmove(Elem->Msg+(LENGTH_802_11 + LENGTH_802_1_H), pPayload, PayloadSize); Elem->MsgLen = LENGTH_802_11 + LENGTH_802_1_H + PayloadSize; WpaEAPOLKeyAction(pAd, Elem); diff --git a/drivers/staging/rt2860/rt_main_dev.c b/drivers/staging/rt2860/rt_main_dev.c index 7f4441462a12..22f37cfbefbe 100644 --- a/drivers/staging/rt2860/rt_main_dev.c +++ b/drivers/staging/rt2860/rt_main_dev.c @@ -777,6 +777,8 @@ INT __devinit rt28xx_probe( // Allocate RTMP_ADAPTER miniport adapter structure handle = kmalloc(sizeof(struct os_cookie), GFP_KERNEL); + if (handle == NULL) + goto err_out_free_netdev;; RT28XX_HANDLE_DEV_ASSIGN(handle, dev_p); status = RTMPAllocAdapterBlock(handle, &pAd); |