From: Iker Pedrosa Date: Fri, 20 Sep 2013 15:11:27 +0000 (+0200) Subject: Staging: rtl8192u: r819xU_cmdpkt: checking NULL value after doing dev_alloc_skb X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=c3aed2312fd3c74e77e049b795e092689d414474;p=sagit-ice-cold%2Fkernel_xiaomi_msm8998.git Staging: rtl8192u: r819xU_cmdpkt: checking NULL value after doing dev_alloc_skb Checking the return of dev_alloc_skb as stated in the following bug: https://bugzilla.kernel.org/show_bug.cgi?id=60411 Signed-off-by: Iker Pedrosa Reported-by: RUC_Soft_Sec rucsoftsec@gmail.com Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/staging/rtl8192u/r819xU_cmdpkt.c b/drivers/staging/rtl8192u/r819xU_cmdpkt.c index 5bc361b16d4c..56144014b7c9 100644 --- a/drivers/staging/rtl8192u/r819xU_cmdpkt.c +++ b/drivers/staging/rtl8192u/r819xU_cmdpkt.c @@ -37,6 +37,8 @@ rt_status SendTxCommandPacket(struct net_device *dev, void *pData, u32 DataLen) /* Get TCB and local buffer from common pool. (It is shared by CmdQ, MgntQ, and USB coalesce DataQ) */ skb = dev_alloc_skb(USB_HWDESC_HEADER_LEN + DataLen + 4); + if (!skb) + return RT_STATUS_FAILURE; memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev)); tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE); tcb_desc->queue_index = TXCMD_QUEUE;