The "wep" buffer is not initialized. To avoid memory disclosures,
the fix initializes it, as peer functions like rtllib_ccmp_set_key
do.
Signed-off-by: Kangjie Lu
---
drivers/staging/rtl8192e/rtllib_crypt_wep.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/stagin
When kzalloc fails, "platform_state->inited = 1" is a NULL pointer
dereference. The fix returns VCHIQ_ERROR in case it failed to
avoid NULL pointer dereference.
Signed-off-by: Kangjie Lu
---
.../staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c | 2 ++
1 file changed,
ida_simple_get could fail. The fix inserts a check for its
return value.
Signed-off-by: Kangjie Lu
---
drivers/staging/greybus/audio_manager.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/staging/greybus/audio_manager.c
b/drivers/staging/greybus/audio_manager.c
index
register_netdev() may fail, so let's check its return value, and if it
fails, issue an error message.
Signed-off-by: Kangjie Lu
---
drivers/staging/rtl8712/hal_init.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/rtl8712/hal_init.c
b/drivers/st
register_netdev() may fail, so let's check its return value, and if it
fails, issue an error message.
Signed-off-by: Kangjie Lu
---
drivers/staging/rtl8712/hal_init.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8712/hal_init.c
b/drivers/st
sd_init_power() could fail. The fix inserts a check of its status. If it
fails, returns STATUS_FAIL.
Signed-off-by: Kangjie Lu
---
drivers/staging/rts5208/sd.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/rts5208/sd.c b/drivers/staging/rts5208/sd.c
__netdev_alloc_skb() return NULl when it fails. skb_put() further uses
it even when the allocation fails, leading to NULL pointer dereference.
The fix inserts a check for the return value of __netdev_alloc_skb().
Signed-off-by: Kangjie Lu
---
drivers/staging/rtlwifi/rtl8822be/fw.c | 2 ++
1
ode upon its failure.
Signed-off-by: Kangjie Lu
---
drivers/staging/rts5208/ms.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/rts5208/ms.c b/drivers/staging/rts5208/ms.c
index f53adf15c685..03b359ec69e6 100644
--- a/drivers/staging/rts5208/ms.c
+++ b/drivers/
ms_send_cmd() may fail. The fix checks the return value of it, and if it
fails, returns the error "STATUS_FAIL" upstream.
Signed-off-by: Kangjie Lu
---
drivers/staging/rts5208/ms.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/rts5208/ms.c
"mac" is an array allocated in stack without being initialized,
and will be sent out via "nla_put". The dump_station() is supposed
to initialize the mac address; otherwise, sensitive data in kernel
stack will be leaked. To fix this, copy the mac address to it.
Signe
10 matches
Mail list logo