| From foo@baz Thu Mar 22 14:57:32 CET 2018 |
| From: Pan Bian <bianpan2016@163.com> |
| Date: Mon, 24 Apr 2017 08:40:28 +0800 |
| Subject: rndis_wlan: add return value validation |
| |
| From: Pan Bian <bianpan2016@163.com> |
| |
| |
| [ Upstream commit 9dc7efd3978aa67ae598129d2a3f240b390ce508 ] |
| |
| Function create_singlethread_workqueue() will return a NULL pointer if |
| there is no enough memory, and its return value should be validated |
| before using. However, in function rndis_wlan_bind(), its return value |
| is not checked. This may cause NULL dereference bugs. This patch fixes |
| it. |
| |
| Signed-off-by: Pan Bian <bianpan2016@163.com> |
| Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/wireless/rndis_wlan.c | 4 ++++ |
| 1 file changed, 4 insertions(+) |
| |
| --- a/drivers/net/wireless/rndis_wlan.c |
| +++ b/drivers/net/wireless/rndis_wlan.c |
| @@ -3425,6 +3425,10 @@ static int rndis_wlan_bind(struct usbnet |
| |
| /* because rndis_command() sleeps we need to use workqueue */ |
| priv->workqueue = create_singlethread_workqueue("rndis_wlan"); |
| + if (!priv->workqueue) { |
| + wiphy_free(wiphy); |
| + return -ENOMEM; |
| + } |
| INIT_WORK(&priv->work, rndis_wlan_worker); |
| INIT_DELAYED_WORK(&priv->dev_poller_work, rndis_device_poller); |
| INIT_DELAYED_WORK(&priv->scan_work, rndis_get_scan_results); |