rtlwifi: fix potential NULL pointer dereference

BugLink: https://bugs.launchpad.net/bugs/1838700
[ Upstream commit 60209d482b97743915883d293c8b85226d230c19 ]

In case dev_alloc_skb fails, the fix safely returns to avoid
potential NULL pointer dereference.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/fw.c
index a2eca669873b641dc3efec908f03c535e2b741a1..726d3d5fa2ef9e68a31caaa8f5eba9950ced722f 100644 (file)
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/fw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/fw.c
@@ -620,6 +620,8 @@ void rtl88e_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
                      u1rsvdpageloc, 3);
 
        skb = dev_alloc_skb(totalpacketlen);
+       if (!skb)
+               return;
        skb_put_data(skb, &reserved_page_packet, totalpacketlen);
 
        rtstatus = rtl_cmd_send_packet(hw, skb);

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/fw_common.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/fw_common.c
index 015476e3f7e543dd179d5d75f634151fa7349dba..b7c1d7cc4f459583e4fb824a61d248467770b337 100644 (file)
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/fw_common.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/fw_common.c
@@ -647,6 +647,8 @@ void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw,
 
 
        skb = dev_alloc_skb(totalpacketlen);
+       if (!skb)
+               return;
        skb_put_data(skb, &reserved_page_packet, totalpacketlen);
 
        if (cmd_send_packet)

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c
index f9563ae301ad287c2a4b0976d337ec7e799f6807..45808ab025d1eb0be0bc85c0d286351cba7758c1 100644 (file)
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c
@@ -766,6 +766,8 @@ void rtl92ee_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
                      u1rsvdpageloc, 3);
 
        skb = dev_alloc_skb(totalpacketlen);
+       if (!skb)
+               return;
        skb_put_data(skb, &reserved_page_packet, totalpacketlen);
 
        rtstatus = rtl_cmd_send_packet(hw, skb);

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/fw.c
index bf9859f74b6f5e9bd3349c5dfef799c03c3d3f6e..52f108744e9693b9ed0743a0296062a962086539 100644 (file)
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/fw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/fw.c
@@ -470,6 +470,8 @@ void rtl8723e_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
                      u1rsvdpageloc, 3);
 
        skb = dev_alloc_skb(totalpacketlen);
+       if (!skb)
+               return;
        skb_put_data(skb, &reserved_page_packet, totalpacketlen);
 
        rtstatus = rtl_cmd_send_packet(hw, skb);

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/fw.c
index 4b963fd27d64603acdedd470b6cbcb59a699a3df..b444b27263c3236e7e2d7110f1fb979e690f8827 100644 (file)
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/fw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/fw.c
@@ -584,6 +584,8 @@ void rtl8723be_set_fw_rsvdpagepkt(struct ieee80211_hw *hw,
                      u1rsvdpageloc, sizeof(u1rsvdpageloc));
 
        skb = dev_alloc_skb(totalpacketlen);
+       if (!skb)
+               return;
        skb_put_data(skb, &reserved_page_packet, totalpacketlen);
 
        rtstatus = rtl_cmd_send_packet(hw, skb);

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.c
index f2b2c549e5b2762216e80eef5fb27a89d0860192..53a7ef29fce61ceae775d95e277aa8f7fed8c5ec 100644 (file)
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.c
@@ -1645,6 +1645,8 @@ out:
                      &reserved_page_packet_8812[0], totalpacketlen);
 
        skb = dev_alloc_skb(totalpacketlen);
+       if (!skb)
+               return;
        skb_put_data(skb, &reserved_page_packet_8812, totalpacketlen);
 
        rtstatus = rtl_cmd_send_packet(hw, skb);
@@ -1781,6 +1783,8 @@ out:
                      &reserved_page_packet_8821[0], totalpacketlen);
 
        skb = dev_alloc_skb(totalpacketlen);
+       if (!skb)
+               return;
        skb_put_data(skb, &reserved_page_packet_8821, totalpacketlen);
 
        rtstatus = rtl_cmd_send_packet(hw, skb);