* [PATCH 1/1] mt7601u: check return value of alloc_skb
@ 2017-04-23 7:00 Pan Bian
2017-04-24 3:49 ` Jakub Kicinski
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Pan Bian @ 2017-04-23 7:00 UTC (permalink / raw)
To: Jakub Kicinski, Kalle Valo, Matthias Brugger
Cc: netdev, Pan Bian, linux-wireless, linux-kernel, linux-mediatek,
linux-arm-kernel
Function alloc_skb() will return a NULL pointer if there is no enough
memory. However, in function mt7601u_mcu_msg_alloc(), its return value
is not validated before it is used. This patch fixes it.
Signed-off-by: Pan Bian <bianpan2016@163.com>
---
drivers/net/wireless/mediatek/mt7601u/mcu.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt7601u/mcu.c b/drivers/net/wireless/mediatek/mt7601u/mcu.c
index dbdfb3f..a9f5f39 100644
--- a/drivers/net/wireless/mediatek/mt7601u/mcu.c
+++ b/drivers/net/wireless/mediatek/mt7601u/mcu.c
@@ -66,8 +66,10 @@ static inline void trace_mt_mcu_msg_send_cs(struct mt7601u_dev *dev,
WARN_ON(len % 4); /* if length is not divisible by 4 we need to pad */
skb = alloc_skb(len + MT_DMA_HDR_LEN + 4, GFP_KERNEL);
- skb_reserve(skb, MT_DMA_HDR_LEN);
- memcpy(skb_put(skb, len), data, len);
+ if (skb) {
+ skb_reserve(skb, MT_DMA_HDR_LEN);
+ memcpy(skb_put(skb, len), data, len);
+ }
return skb;
}
@@ -170,6 +172,8 @@ static int mt7601u_mcu_function_select(struct mt7601u_dev *dev,
};
skb = mt7601u_mcu_msg_alloc(dev, &msg, sizeof(msg));
+ if (!skb)
+ return -ENOMEM;
return mt7601u_mcu_msg_send(dev, skb, CMD_FUN_SET_OP, func == 5);
}
@@ -205,6 +209,8 @@ int mt7601u_mcu_tssi_read_kick(struct mt7601u_dev *dev, int use_hvga)
};
skb = mt7601u_mcu_msg_alloc(dev, &msg, sizeof(msg));
+ if (!skb)
+ return -ENOMEM;
return mt7601u_mcu_msg_send(dev, skb, CMD_CALIBRATION_OP, true);
}
--
1.9.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH 1/1] mt7601u: check return value of alloc_skb
2017-04-23 7:00 [PATCH 1/1] mt7601u: check return value of alloc_skb Pan Bian
@ 2017-04-24 3:49 ` Jakub Kicinski
[not found] ` <1492930823-17249-1-git-send-email-bianpan2016-9Onoh4P/yGk@public.gmane.org>
2017-04-26 9:03 ` Kalle Valo
2 siblings, 0 replies; 4+ messages in thread
From: Jakub Kicinski @ 2017-04-24 3:49 UTC (permalink / raw)
To: Pan Bian
Cc: Kalle Valo, Matthias Brugger, linux-wireless, netdev,
linux-kernel, linux-arm-kernel, linux-mediatek
On Sun, 23 Apr 2017 15:00:23 +0800, Pan Bian wrote:
> Function alloc_skb() will return a NULL pointer if there is no enough
> memory. However, in function mt7601u_mcu_msg_alloc(), its return value
> is not validated before it is used. This patch fixes it.
>
> Signed-off-by: Pan Bian <bianpan2016@163.com>
Acked-by: Jakub Kicinski <kubakici@wp.pl>
Thanks!
^ permalink raw reply [flat|nested] 4+ messages in thread[parent not found: <1492930823-17249-1-git-send-email-bianpan2016-9Onoh4P/yGk@public.gmane.org>]
* Re: [1/1] mt7601u: check return value of alloc_skb
[not found] ` <1492930823-17249-1-git-send-email-bianpan2016-9Onoh4P/yGk@public.gmane.org>
@ 2017-04-26 9:03 ` Kalle Valo
0 siblings, 0 replies; 4+ messages in thread
From: Kalle Valo @ 2017-04-26 9:03 UTC (permalink / raw)
To: Pan Bian
Cc: Jakub Kicinski, Matthias Brugger,
linux-wireless-u79uwXL29TY76Z2rM5mHXA,
netdev-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
linux-arm-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r,
linux-mediatek-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r, Pan Bian
Pan Bian <bianpan2016-9Onoh4P/yGk@public.gmane.org> wrote:
> Function alloc_skb() will return a NULL pointer if there is no enough
> memory. However, in function mt7601u_mcu_msg_alloc(), its return value
> is not validated before it is used. This patch fixes it.
>
> Signed-off-by: Pan Bian <bianpan2016-9Onoh4P/yGk@public.gmane.org>
> Acked-by: Jakub Kicinski <kubakici-5tc4TXWwyLM@public.gmane.org>
Patch applied to wireless-drivers-next.git, thanks.
5fb01e91daf8 mt7601u: check return value of alloc_skb
--
https://patchwork.kernel.org/patch/9694549/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [1/1] mt7601u: check return value of alloc_skb
2017-04-23 7:00 [PATCH 1/1] mt7601u: check return value of alloc_skb Pan Bian
2017-04-24 3:49 ` Jakub Kicinski
[not found] ` <1492930823-17249-1-git-send-email-bianpan2016-9Onoh4P/yGk@public.gmane.org>
@ 2017-04-26 9:03 ` Kalle Valo
2 siblings, 0 replies; 4+ messages in thread
From: Kalle Valo @ 2017-04-26 9:03 UTC (permalink / raw)
To: Pan Bian
Cc: Jakub Kicinski, netdev, Pan Bian, linux-wireless, linux-kernel,
linux-mediatek, Matthias Brugger, linux-arm-kernel
Pan Bian <bianpan2016@163.com> wrote:
> Function alloc_skb() will return a NULL pointer if there is no enough
> memory. However, in function mt7601u_mcu_msg_alloc(), its return value
> is not validated before it is used. This patch fixes it.
>
> Signed-off-by: Pan Bian <bianpan2016@163.com>
> Acked-by: Jakub Kicinski <kubakici@wp.pl>
Patch applied to wireless-drivers-next.git, thanks.
5fb01e91daf8 mt7601u: check return value of alloc_skb
--
https://patchwork.kernel.org/patch/9694549/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-04-26 9:03 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-04-23 7:00 [PATCH 1/1] mt7601u: check return value of alloc_skb Pan Bian
2017-04-24 3:49 ` Jakub Kicinski
[not found] ` <1492930823-17249-1-git-send-email-bianpan2016-9Onoh4P/yGk@public.gmane.org>
2017-04-26 9:03 ` [1/1] " Kalle Valo
2017-04-26 9:03 ` Kalle Valo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).