On Mon, Sep 08, 2014 at 06:36:34AM -0400, nick wrote:
Hey Guys, Found a bug and attempted to fix it. I am attaching the patch, no build or checkpatch errors and also checked to see if I need to clean up any memory when returning, and this seems to be true. Nick
From d5f7b8929bebcf0b12d8e402932b790f61786168 Mon Sep 17 00:00:00 2001 From: Nicholas Krause <xerofoify@gmail.com> Date: Mon, 8 Sep 2014 05:57:09 -0400 Subject: [PATCH] staging: Fix ieee_80211_rx.c to check for Null allocated skb
In ieee_80211_rx.c we may have a Null allocated sub in parse_subframe and need to check if the allocated skb is NUll. If it is return -ENOMEM.
Signed-off-by: Nicholas Krause <xerofoify@gmail.com> --- drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c index 73410cc..dc8520d 100644 --- a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c +++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c @@ -847,6 +847,8 @@ static u8 parse_subframe(struct sk_buff *skb, #else /* Allocate new skb for releasing to upper layer */ sub_skb = dev_alloc_skb(nSubframe_Length + 12); + if (!sub_skb) + return -ENOMEM; parse_subframe is returning 0 as error. if you see the functions that are calling parse_subframe , you will see they are comparing the return value with zero for failure. So you are returning -ENOMEM that is a success and it will try to process that frame , and i hope you can imagine what happens next.
thanks sudip
skb_reserve(sub_skb, 12); data_ptr = (u8 *)skb_put(sub_skb, nSubframe_Length); memcpy(data_ptr,skb->data,nSubframe_Length); -- 1.9.1
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies