| From foo@baz Thu Mar 22 14:57:32 CET 2018 |
| From: Pan Bian <bianpan2016@163.com> |
| Date: Sun, 23 Apr 2017 19:53:58 +0800 |
| Subject: staging: wilc1000: fix unchecked return value |
| |
| From: Pan Bian <bianpan2016@163.com> |
| |
| |
| [ Upstream commit 9e96652756ad647b7bcc03cb99ffc9756d7b5f93 ] |
| |
| Function dev_alloc_skb() will return a NULL pointer if there is no |
| enough memory. However, in function WILC_WFI_mon_xmit(), its return |
| value is used without validation. This may result in a bad memory access |
| bug. This patch fixes the bug. |
| |
| Signed-off-by: Pan Bian <bianpan2016@163.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/staging/wilc1000/linux_mon.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| --- a/drivers/staging/wilc1000/linux_mon.c |
| +++ b/drivers/staging/wilc1000/linux_mon.c |
| @@ -251,6 +251,8 @@ static netdev_tx_t WILC_WFI_mon_xmit(str |
| |
| if (skb->data[0] == 0xc0 && (!(memcmp(broadcast, &skb->data[4], 6)))) { |
| skb2 = dev_alloc_skb(skb->len + sizeof(struct wilc_wfi_radiotap_cb_hdr)); |
| + if (!skb2) |
| + return -ENOMEM; |
| |
| memcpy(skb_put(skb2, skb->len), skb->data, skb->len); |
| |
