rtlwifi: rtl8192c_common: rtl8192de: Check for allocation failures

commit 76a92be537f1c8c259e393632301446257ca3ea9 upstream.

In https://bugzilla.redhat.com/show_bug.cgi?id=771656, a kernel bug was
triggered due to a failed skb allocation that was not checked. This event
lead to an audit of all memory allocations in the complete rtlwifi family
of drivers. This patch fixes the rest.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index eb61061..19bb550 100644 (file)
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -657,6 +657,8 @@ static void _rtl_receive_one(struct ieee80211_hw *hw, struct sk_buff *skb,
                return;
 
        uskb = dev_alloc_skb(skb->len + 128);
+       if (!uskb)
+               return;         /* exit if allocation failed */
        memcpy(IEEE80211_SKB_RXCB(uskb), &rx_status, sizeof(rx_status));
        pdata = (u8 *)skb_put(uskb, skb->len);
        memcpy(pdata, skb->data, skb->len);

diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
index 950c65a..13fc0f9 100644 (file)
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
@@ -752,6 +752,8 @@ void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool dl_finished)
 
 
        skb = dev_alloc_skb(totalpacketlen);
+       if (!skb)
+               return;
        memcpy((u8 *) skb_put(skb, totalpacketlen),
               &reserved_page_packet, totalpacketlen);
 

diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/fw.c b/drivers/net/wireless/rtlwifi/rtl8192de/fw.c
index 82f060b..c44757f 100644 (file)
--- a/drivers/net/wireless/rtlwifi/rtl8192de/fw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/fw.c
@@ -763,12 +763,16 @@ void rtl92d_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool dl_finished)
                      "rtl92d_set_fw_rsvdpagepkt(): HW_VAR_SET_TX_CMD: ALL\n",
                      u1RsvdPageLoc, 3);
        skb = dev_alloc_skb(totalpacketlen);
-       memcpy((u8 *) skb_put(skb, totalpacketlen), &reserved_page_packet,
-               totalpacketlen);
-       rtstatus = _rtl92d_cmd_send_packet(hw, skb);
+       if (!skb) {
+               dlok = false;
+       } else {
+               memcpy((u8 *) skb_put(skb, totalpacketlen),
+                       &reserved_page_packet, totalpacketlen);
+               rtstatus = _rtl92d_cmd_send_packet(hw, skb);
 
-       if (rtstatus)
-               dlok = true;
+               if (rtstatus)
+                       dlok = true;
+       }
        if (dlok) {
                RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
                        ("Set RSVD page location to Fw.\n"));

diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 54cb8a6..2b7bcc8 100644 (file)
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -481,12 +481,14 @@ static void _rtl_usb_rx_process_noagg(struct ieee80211_hw *hw,
                        u8 *pdata;
 
                        uskb = dev_alloc_skb(skb->len + 128);
-                       memcpy(IEEE80211_SKB_RXCB(uskb), &rx_status,
-                              sizeof(rx_status));
-                       pdata = (u8 *)skb_put(uskb, skb->len);
-                       memcpy(pdata, skb->data, skb->len);
+                       if (uskb) {     /* drop packet on allocation failure */
+                               memcpy(IEEE80211_SKB_RXCB(uskb), &rx_status,
+                                      sizeof(rx_status));
+                               pdata = (u8 *)skb_put(uskb, skb->len);
+                               memcpy(pdata, skb->data, skb->len);
+                               ieee80211_rx_irqsafe(hw, uskb);
+                       }
                        dev_kfree_skb_any(skb);
-                       ieee80211_rx_irqsafe(hw, uskb);
                } else {
                        dev_kfree_skb_any(skb);
                }